1 /* SPDX-License-Identifier: GPL-2.0 */
2 #ifndef _NET_XFRM_H
3 #define _NET_XFRM_H
4
5 #include <linux/compiler.h>
6 #include <linux/xfrm.h>
7 #include <linux/spinlock.h>
8 #include <linux/list.h>
9 #include <linux/skbuff.h>
10 #include <linux/socket.h>
11 #include <linux/pfkeyv2.h>
12 #include <linux/ipsec.h>
13 #include <linux/in6.h>
14 #include <linux/mutex.h>
15 #include <linux/audit.h>
16 #include <linux/slab.h>
17 #include <linux/refcount.h>
18 #include <linux/sockptr.h>
19
20 #include <net/sock.h>
21 #include <net/dst.h>
22 #include <net/ip.h>
23 #include <net/route.h>
24 #include <net/ipv6.h>
25 #include <net/ip6_fib.h>
26 #include <net/flow.h>
27 #include <net/gro_cells.h>
28
29 #include <linux/interrupt.h>
30
31 #ifdef CONFIG_XFRM_STATISTICS
32 #include <net/snmp.h>
33 #endif
34
35 #define XFRM_PROTO_ESP 50
36 #define XFRM_PROTO_AH 51
37 #define XFRM_PROTO_COMP 108
38 #define XFRM_PROTO_IPIP 4
39 #define XFRM_PROTO_IPV6 41
40 #define XFRM_PROTO_ROUTING IPPROTO_ROUTING
41 #define XFRM_PROTO_DSTOPTS IPPROTO_DSTOPTS
42
43 #define XFRM_ALIGN4(len) (((len) + 3) & ~3)
44 #define XFRM_ALIGN8(len) (((len) + 7) & ~7)
45 #define MODULE_ALIAS_XFRM_MODE(family, encap) \
46 MODULE_ALIAS("xfrm-mode-" __stringify(family) "-" __stringify(encap))
47 #define MODULE_ALIAS_XFRM_TYPE(family, proto) \
48 MODULE_ALIAS("xfrm-type-" __stringify(family) "-" __stringify(proto))
49 #define MODULE_ALIAS_XFRM_OFFLOAD_TYPE(family, proto) \
50 MODULE_ALIAS("xfrm-offload-" __stringify(family) "-" __stringify(proto))
51
52 #ifdef CONFIG_XFRM_STATISTICS
53 #define XFRM_INC_STATS(net, field) SNMP_INC_STATS((net)->mib.xfrm_statistics, field)
54 #else
55 #define XFRM_INC_STATS(net, field) ((void)(net))
56 #endif
57
58
59 /* Organization of SPD aka "XFRM rules"
60 ------------------------------------
61
62 Basic objects:
63 - policy rule, struct xfrm_policy (=SPD entry)
64 - bundle of transformations, struct dst_entry == struct xfrm_dst (=SA bundle)
65 - instance of a transformer, struct xfrm_state (=SA)
66 - template to clone xfrm_state, struct xfrm_tmpl
67
68 SPD is plain linear list of xfrm_policy rules, ordered by priority.
69 (To be compatible with existing pfkeyv2 implementations,
70 many rules with priority of 0x7fffffff are allowed to exist and
71 such rules are ordered in an unpredictable way, thanks to bsd folks.)
72
73 Lookup is plain linear search until the first match with selector.
74
75 If "action" is "block", then we prohibit the flow, otherwise:
76 if "xfrms_nr" is zero, the flow passes untransformed. Otherwise,
77 policy entry has list of up to XFRM_MAX_DEPTH transformations,
78 described by templates xfrm_tmpl. Each template is resolved
79 to a complete xfrm_state (see below) and we pack bundle of transformations
80 to a dst_entry returned to requestor.
81
82 dst -. xfrm .-> xfrm_state #1
83 |---. child .-> dst -. xfrm .-> xfrm_state #2
84 |---. child .-> dst -. xfrm .-> xfrm_state #3
85 |---. child .-> NULL
86
87 Bundles are cached at xrfm_policy struct (field ->bundles).
88
89
90 Resolution of xrfm_tmpl
91 -----------------------
92 Template contains:
93 1. ->mode Mode: transport or tunnel
94 2. ->id.proto Protocol: AH/ESP/IPCOMP
95 3. ->id.daddr Remote tunnel endpoint, ignored for transport mode.
96 Q: allow to resolve security gateway?
97 4. ->id.spi If not zero, static SPI.
98 5. ->saddr Local tunnel endpoint, ignored for transport mode.
99 6. ->algos List of allowed algos. Plain bitmask now.
100 Q: ealgos, aalgos, calgos. What a mess...
101 7. ->share Sharing mode.
102 Q: how to implement private sharing mode? To add struct sock* to
103 flow id?
104
105 Having this template we search through SAD searching for entries
106 with appropriate mode/proto/algo, permitted by selector.
107 If no appropriate entry found, it is requested from key manager.
108
109 PROBLEMS:
110 Q: How to find all the bundles referring to a physical path for
111 PMTU discovery? Seems, dst should contain list of all parents...
112 and enter to infinite locking hierarchy disaster.
113 No! It is easier, we will not search for them, let them find us.
114 We add genid to each dst plus pointer to genid of raw IP route,
115 pmtu disc will update pmtu on raw IP route and increase its genid.
116 dst_check() will see this for top level and trigger resyncing
117 metrics. Plus, it will be made via sk->sk_dst_cache. Solved.
118 */
119
120 struct xfrm_state_walk {
121 struct list_head all;
122 u8 state;
123 u8 dying;
124 u8 proto;
125 u32 seq;
126 struct xfrm_address_filter *filter;
127 };
128
129 struct xfrm_state_offload {
130 struct net_device *dev;
131 struct net_device *real_dev;
132 unsigned long offload_handle;
133 unsigned int num_exthdrs;
134 u8 flags;
135 };
136
137 struct xfrm_mode {
138 u8 encap;
139 u8 family;
140 u8 flags;
141 };
142
143 /* Flags for xfrm_mode. */
144 enum {
145 XFRM_MODE_FLAG_TUNNEL = 1,
146 };
147
148 /* Full description of state of transformer. */
149 struct xfrm_state {
150 possible_net_t xs_net;
151 union {
152 struct hlist_node gclist;
153 struct hlist_node bydst;
154 };
155 struct hlist_node bysrc;
156 struct hlist_node byspi;
157
158 refcount_t refcnt;
159 spinlock_t lock;
160
161 struct xfrm_id id;
162 struct xfrm_selector sel;
163 struct xfrm_mark mark;
164 u32 if_id;
165 u32 tfcpad;
166
167 u32 genid;
168
169 /* Key manager bits */
170 struct xfrm_state_walk km;
171
172 /* Parameters of this state. */
173 struct {
174 u32 reqid;
175 u8 mode;
176 u8 replay_window;
177 u8 aalgo, ealgo, calgo;
178 u8 flags;
179 u16 family;
180 xfrm_address_t saddr;
181 int header_len;
182 int trailer_len;
183 u32 extra_flags;
184 struct xfrm_mark smark;
185 } props;
186
187 struct xfrm_lifetime_cfg lft;
188
189 /* Data for transformer */
190 struct xfrm_algo_auth *aalg;
191 struct xfrm_algo *ealg;
192 struct xfrm_algo *calg;
193 struct xfrm_algo_aead *aead;
194 const char *geniv;
195
196 /* mapping change rate limiting */
197 __be16 new_mapping_sport;
198 u32 new_mapping; /* seconds */
199 u32 mapping_maxage; /* seconds for input SA */
200
201 /* Data for encapsulator */
202 struct xfrm_encap_tmpl *encap;
203 struct sock __rcu *encap_sk;
204
205 /* Data for care-of address */
206 xfrm_address_t *coaddr;
207
208 /* IPComp needs an IPIP tunnel for handling uncompressed packets */
209 struct xfrm_state *tunnel;
210
211 /* If a tunnel, number of users + 1 */
212 atomic_t tunnel_users;
213
214 /* State for replay detection */
215 struct xfrm_replay_state replay;
216 struct xfrm_replay_state_esn *replay_esn;
217
218 /* Replay detection state at the time we sent the last notification */
219 struct xfrm_replay_state preplay;
220 struct xfrm_replay_state_esn *preplay_esn;
221
222 /* The functions for replay detection. */
223 const struct xfrm_replay *repl;
224
225 /* internal flag that only holds state for delayed aevent at the
226 * moment
227 */
228 u32 xflags;
229
230 /* Replay detection notification settings */
231 u32 replay_maxage;
232 u32 replay_maxdiff;
233
234 /* Replay detection notification timer */
235 struct timer_list rtimer;
236
237 /* Statistics */
238 struct xfrm_stats stats;
239
240 struct xfrm_lifetime_cur curlft;
241 struct hrtimer mtimer;
242
243 struct xfrm_state_offload xso;
244
245 /* used to fix curlft->add_time when changing date */
246 long saved_tmo;
247
248 /* Last used time */
249 time64_t lastused;
250
251 struct page_frag xfrag;
252
253 /* Reference to data common to all the instances of this
254 * transformer. */
255 const struct xfrm_type *type;
256 struct xfrm_mode inner_mode;
257 struct xfrm_mode inner_mode_iaf;
258 struct xfrm_mode outer_mode;
259
260 const struct xfrm_type_offload *type_offload;
261
262 /* Security context */
263 struct xfrm_sec_ctx *security;
264
265 /* Private data of this transformer, format is opaque,
266 * interpreted by xfrm_type methods. */
267 void *data;
268 };
269
xs_net(struct xfrm_state * x)270 static inline struct net *xs_net(struct xfrm_state *x)
271 {
272 return read_pnet(&x->xs_net);
273 }
274
275 /* xflags - make enum if more show up */
276 #define XFRM_TIME_DEFER 1
277 #define XFRM_SOFT_EXPIRE 2
278
279 enum {
280 XFRM_STATE_VOID,
281 XFRM_STATE_ACQ,
282 XFRM_STATE_VALID,
283 XFRM_STATE_ERROR,
284 XFRM_STATE_EXPIRED,
285 XFRM_STATE_DEAD
286 };
287
288 /* callback structure passed from either netlink or pfkey */
289 struct km_event {
290 union {
291 u32 hard;
292 u32 proto;
293 u32 byid;
294 u32 aevent;
295 u32 type;
296 } data;
297
298 u32 seq;
299 u32 portid;
300 u32 event;
301 struct net *net;
302 };
303
304 struct xfrm_replay {
305 void (*advance)(struct xfrm_state *x, __be32 net_seq);
306 int (*check)(struct xfrm_state *x,
307 struct sk_buff *skb,
308 __be32 net_seq);
309 int (*recheck)(struct xfrm_state *x,
310 struct sk_buff *skb,
311 __be32 net_seq);
312 void (*notify)(struct xfrm_state *x, int event);
313 int (*overflow)(struct xfrm_state *x, struct sk_buff *skb);
314 };
315
316 struct xfrm_if_cb {
317 struct xfrm_if *(*decode_session)(struct sk_buff *skb,
318 unsigned short family);
319 };
320
321 void xfrm_if_register_cb(const struct xfrm_if_cb *ifcb);
322 void xfrm_if_unregister_cb(void);
323
324 struct net_device;
325 struct xfrm_type;
326 struct xfrm_dst;
327 struct xfrm_policy_afinfo {
328 struct dst_ops *dst_ops;
329 struct dst_entry *(*dst_lookup)(struct net *net,
330 int tos, int oif,
331 const xfrm_address_t *saddr,
332 const xfrm_address_t *daddr,
333 u32 mark);
334 int (*get_saddr)(struct net *net, int oif,
335 xfrm_address_t *saddr,
336 xfrm_address_t *daddr,
337 u32 mark);
338 int (*fill_dst)(struct xfrm_dst *xdst,
339 struct net_device *dev,
340 const struct flowi *fl);
341 struct dst_entry *(*blackhole_route)(struct net *net, struct dst_entry *orig);
342 };
343
344 int xfrm_policy_register_afinfo(const struct xfrm_policy_afinfo *afinfo, int family);
345 void xfrm_policy_unregister_afinfo(const struct xfrm_policy_afinfo *afinfo);
346 void km_policy_notify(struct xfrm_policy *xp, int dir,
347 const struct km_event *c);
348 void km_state_notify(struct xfrm_state *x, const struct km_event *c);
349
350 struct xfrm_tmpl;
351 int km_query(struct xfrm_state *x, struct xfrm_tmpl *t,
352 struct xfrm_policy *pol);
353 void km_state_expired(struct xfrm_state *x, int hard, u32 portid);
354 int __xfrm_state_delete(struct xfrm_state *x);
355
356 struct xfrm_state_afinfo {
357 u8 family;
358 u8 proto;
359
360 const struct xfrm_type_offload *type_offload_esp;
361
362 const struct xfrm_type *type_esp;
363 const struct xfrm_type *type_ipip;
364 const struct xfrm_type *type_ipip6;
365 const struct xfrm_type *type_comp;
366 const struct xfrm_type *type_ah;
367 const struct xfrm_type *type_routing;
368 const struct xfrm_type *type_dstopts;
369
370 int (*output)(struct net *net, struct sock *sk, struct sk_buff *skb);
371 int (*transport_finish)(struct sk_buff *skb,
372 int async);
373 void (*local_error)(struct sk_buff *skb, u32 mtu);
374 };
375
376 int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo);
377 int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo);
378 struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family);
379 struct xfrm_state_afinfo *xfrm_state_afinfo_get_rcu(unsigned int family);
380
381 struct xfrm_input_afinfo {
382 u8 family;
383 bool is_ipip;
384 int (*callback)(struct sk_buff *skb, u8 protocol,
385 int err);
386 };
387
388 int xfrm_input_register_afinfo(const struct xfrm_input_afinfo *afinfo);
389 int xfrm_input_unregister_afinfo(const struct xfrm_input_afinfo *afinfo);
390
391 void xfrm_flush_gc(void);
392 void xfrm_state_delete_tunnel(struct xfrm_state *x);
393
394 struct xfrm_type {
395 char *description;
396 struct module *owner;
397 u8 proto;
398 u8 flags;
399 #define XFRM_TYPE_NON_FRAGMENT 1
400 #define XFRM_TYPE_REPLAY_PROT 2
401 #define XFRM_TYPE_LOCAL_COADDR 4
402 #define XFRM_TYPE_REMOTE_COADDR 8
403
404 int (*init_state)(struct xfrm_state *x);
405 void (*destructor)(struct xfrm_state *);
406 int (*input)(struct xfrm_state *, struct sk_buff *skb);
407 int (*output)(struct xfrm_state *, struct sk_buff *pskb);
408 int (*reject)(struct xfrm_state *, struct sk_buff *,
409 const struct flowi *);
410 int (*hdr_offset)(struct xfrm_state *, struct sk_buff *, u8 **);
411 };
412
413 int xfrm_register_type(const struct xfrm_type *type, unsigned short family);
414 void xfrm_unregister_type(const struct xfrm_type *type, unsigned short family);
415
416 struct xfrm_type_offload {
417 char *description;
418 struct module *owner;
419 u8 proto;
420 void (*encap)(struct xfrm_state *, struct sk_buff *pskb);
421 int (*input_tail)(struct xfrm_state *x, struct sk_buff *skb);
422 int (*xmit)(struct xfrm_state *, struct sk_buff *pskb, netdev_features_t features);
423 };
424
425 int xfrm_register_type_offload(const struct xfrm_type_offload *type, unsigned short family);
426 void xfrm_unregister_type_offload(const struct xfrm_type_offload *type, unsigned short family);
427
xfrm_af2proto(unsigned int family)428 static inline int xfrm_af2proto(unsigned int family)
429 {
430 switch(family) {
431 case AF_INET:
432 return IPPROTO_IPIP;
433 case AF_INET6:
434 return IPPROTO_IPV6;
435 default:
436 return 0;
437 }
438 }
439
xfrm_ip2inner_mode(struct xfrm_state * x,int ipproto)440 static inline const struct xfrm_mode *xfrm_ip2inner_mode(struct xfrm_state *x, int ipproto)
441 {
442 if ((ipproto == IPPROTO_IPIP && x->props.family == AF_INET) ||
443 (ipproto == IPPROTO_IPV6 && x->props.family == AF_INET6))
444 return &x->inner_mode;
445 else
446 return &x->inner_mode_iaf;
447 }
448
449 struct xfrm_tmpl {
450 /* id in template is interpreted as:
451 * daddr - destination of tunnel, may be zero for transport mode.
452 * spi - zero to acquire spi. Not zero if spi is static, then
453 * daddr must be fixed too.
454 * proto - AH/ESP/IPCOMP
455 */
456 struct xfrm_id id;
457
458 /* Source address of tunnel. Ignored, if it is not a tunnel. */
459 xfrm_address_t saddr;
460
461 unsigned short encap_family;
462
463 u32 reqid;
464
465 /* Mode: transport, tunnel etc. */
466 u8 mode;
467
468 /* Sharing mode: unique, this session only, this user only etc. */
469 u8 share;
470
471 /* May skip this transfomration if no SA is found */
472 u8 optional;
473
474 /* Skip aalgos/ealgos/calgos checks. */
475 u8 allalgs;
476
477 /* Bit mask of algos allowed for acquisition */
478 u32 aalgos;
479 u32 ealgos;
480 u32 calgos;
481 };
482
483 #define XFRM_MAX_DEPTH 6
484 #define XFRM_MAX_OFFLOAD_DEPTH 1
485
486 struct xfrm_policy_walk_entry {
487 struct list_head all;
488 u8 dead;
489 };
490
491 struct xfrm_policy_walk {
492 struct xfrm_policy_walk_entry walk;
493 u8 type;
494 u32 seq;
495 };
496
497 struct xfrm_policy_queue {
498 struct sk_buff_head hold_queue;
499 struct timer_list hold_timer;
500 unsigned long timeout;
501 };
502
503 struct xfrm_policy {
504 possible_net_t xp_net;
505 struct hlist_node bydst;
506 struct hlist_node byidx;
507
508 /* This lock only affects elements except for entry. */
509 rwlock_t lock;
510 refcount_t refcnt;
511 u32 pos;
512 struct timer_list timer;
513
514 atomic_t genid;
515 u32 priority;
516 u32 index;
517 u32 if_id;
518 struct xfrm_mark mark;
519 struct xfrm_selector selector;
520 struct xfrm_lifetime_cfg lft;
521 struct xfrm_lifetime_cur curlft;
522 struct xfrm_policy_walk_entry walk;
523 struct xfrm_policy_queue polq;
524 bool bydst_reinsert;
525 u8 type;
526 u8 action;
527 u8 flags;
528 u8 xfrm_nr;
529 u16 family;
530 struct xfrm_sec_ctx *security;
531 struct xfrm_tmpl xfrm_vec[XFRM_MAX_DEPTH];
532 struct hlist_node bydst_inexact_list;
533 struct rcu_head rcu;
534 };
535
xp_net(const struct xfrm_policy * xp)536 static inline struct net *xp_net(const struct xfrm_policy *xp)
537 {
538 return read_pnet(&xp->xp_net);
539 }
540
541 struct xfrm_kmaddress {
542 xfrm_address_t local;
543 xfrm_address_t remote;
544 u32 reserved;
545 u16 family;
546 };
547
548 struct xfrm_migrate {
549 xfrm_address_t old_daddr;
550 xfrm_address_t old_saddr;
551 xfrm_address_t new_daddr;
552 xfrm_address_t new_saddr;
553 u8 proto;
554 u8 mode;
555 u16 reserved;
556 u32 reqid;
557 u16 old_family;
558 u16 new_family;
559 };
560
561 #define XFRM_KM_TIMEOUT 30
562 /* what happened */
563 #define XFRM_REPLAY_UPDATE XFRM_AE_CR
564 #define XFRM_REPLAY_TIMEOUT XFRM_AE_CE
565
566 /* default aevent timeout in units of 100ms */
567 #define XFRM_AE_ETIME 10
568 /* Async Event timer multiplier */
569 #define XFRM_AE_ETH_M 10
570 /* default seq threshold size */
571 #define XFRM_AE_SEQT_SIZE 2
572
573 struct xfrm_mgr {
574 struct list_head list;
575 int (*notify)(struct xfrm_state *x, const struct km_event *c);
576 int (*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp);
577 struct xfrm_policy *(*compile_policy)(struct sock *sk, int opt, u8 *data, int len, int *dir);
578 int (*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
579 int (*notify_policy)(struct xfrm_policy *x, int dir, const struct km_event *c);
580 int (*report)(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr);
581 int (*migrate)(const struct xfrm_selector *sel,
582 u8 dir, u8 type,
583 const struct xfrm_migrate *m,
584 int num_bundles,
585 const struct xfrm_kmaddress *k,
586 const struct xfrm_encap_tmpl *encap);
587 bool (*is_alive)(const struct km_event *c);
588 };
589
590 int xfrm_register_km(struct xfrm_mgr *km);
591 int xfrm_unregister_km(struct xfrm_mgr *km);
592
593 struct xfrm_tunnel_skb_cb {
594 union {
595 struct inet_skb_parm h4;
596 struct inet6_skb_parm h6;
597 } header;
598
599 union {
600 struct ip_tunnel *ip4;
601 struct ip6_tnl *ip6;
602 } tunnel;
603 };
604
605 #define XFRM_TUNNEL_SKB_CB(__skb) ((struct xfrm_tunnel_skb_cb *)&((__skb)->cb[0]))
606
607 /*
608 * This structure is used for the duration where packets are being
609 * transformed by IPsec. As soon as the packet leaves IPsec the
610 * area beyond the generic IP part may be overwritten.
611 */
612 struct xfrm_skb_cb {
613 struct xfrm_tunnel_skb_cb header;
614
615 /* Sequence number for replay protection. */
616 union {
617 struct {
618 __u32 low;
619 __u32 hi;
620 } output;
621 struct {
622 __be32 low;
623 __be32 hi;
624 } input;
625 } seq;
626 };
627
628 #define XFRM_SKB_CB(__skb) ((struct xfrm_skb_cb *)&((__skb)->cb[0]))
629
630 /*
631 * This structure is used by the afinfo prepare_input/prepare_output functions
632 * to transmit header information to the mode input/output functions.
633 */
634 struct xfrm_mode_skb_cb {
635 struct xfrm_tunnel_skb_cb header;
636
637 /* Copied from header for IPv4, always set to zero and DF for IPv6. */
638 __be16 id;
639 __be16 frag_off;
640
641 /* IP header length (excluding options or extension headers). */
642 u8 ihl;
643
644 /* TOS for IPv4, class for IPv6. */
645 u8 tos;
646
647 /* TTL for IPv4, hop limitfor IPv6. */
648 u8 ttl;
649
650 /* Protocol for IPv4, NH for IPv6. */
651 u8 protocol;
652
653 /* Option length for IPv4, zero for IPv6. */
654 u8 optlen;
655
656 /* Used by IPv6 only, zero for IPv4. */
657 u8 flow_lbl[3];
658 };
659
660 #define XFRM_MODE_SKB_CB(__skb) ((struct xfrm_mode_skb_cb *)&((__skb)->cb[0]))
661
662 /*
663 * This structure is used by the input processing to locate the SPI and
664 * related information.
665 */
666 struct xfrm_spi_skb_cb {
667 struct xfrm_tunnel_skb_cb header;
668
669 unsigned int daddroff;
670 unsigned int family;
671 __be32 seq;
672 };
673
674 #define XFRM_SPI_SKB_CB(__skb) ((struct xfrm_spi_skb_cb *)&((__skb)->cb[0]))
675
676 #ifdef CONFIG_AUDITSYSCALL
xfrm_audit_start(const char * op)677 static inline struct audit_buffer *xfrm_audit_start(const char *op)
678 {
679 struct audit_buffer *audit_buf = NULL;
680
681 if (audit_enabled == AUDIT_OFF)
682 return NULL;
683 audit_buf = audit_log_start(audit_context(), GFP_ATOMIC,
684 AUDIT_MAC_IPSEC_EVENT);
685 if (audit_buf == NULL)
686 return NULL;
687 audit_log_format(audit_buf, "op=%s", op);
688 return audit_buf;
689 }
690
xfrm_audit_helper_usrinfo(bool task_valid,struct audit_buffer * audit_buf)691 static inline void xfrm_audit_helper_usrinfo(bool task_valid,
692 struct audit_buffer *audit_buf)
693 {
694 const unsigned int auid = from_kuid(&init_user_ns, task_valid ?
695 audit_get_loginuid(current) :
696 INVALID_UID);
697 const unsigned int ses = task_valid ? audit_get_sessionid(current) :
698 AUDIT_SID_UNSET;
699
700 audit_log_format(audit_buf, " auid=%u ses=%u", auid, ses);
701 audit_log_task_context(audit_buf);
702 }
703
704 void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, bool task_valid);
705 void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
706 bool task_valid);
707 void xfrm_audit_state_add(struct xfrm_state *x, int result, bool task_valid);
708 void xfrm_audit_state_delete(struct xfrm_state *x, int result, bool task_valid);
709 void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
710 struct sk_buff *skb);
711 void xfrm_audit_state_replay(struct xfrm_state *x, struct sk_buff *skb,
712 __be32 net_seq);
713 void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family);
714 void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, __be32 net_spi,
715 __be32 net_seq);
716 void xfrm_audit_state_icvfail(struct xfrm_state *x, struct sk_buff *skb,
717 u8 proto);
718 #else
719
xfrm_audit_policy_add(struct xfrm_policy * xp,int result,bool task_valid)720 static inline void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
721 bool task_valid)
722 {
723 }
724
xfrm_audit_policy_delete(struct xfrm_policy * xp,int result,bool task_valid)725 static inline void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
726 bool task_valid)
727 {
728 }
729
xfrm_audit_state_add(struct xfrm_state * x,int result,bool task_valid)730 static inline void xfrm_audit_state_add(struct xfrm_state *x, int result,
731 bool task_valid)
732 {
733 }
734
xfrm_audit_state_delete(struct xfrm_state * x,int result,bool task_valid)735 static inline void xfrm_audit_state_delete(struct xfrm_state *x, int result,
736 bool task_valid)
737 {
738 }
739
xfrm_audit_state_replay_overflow(struct xfrm_state * x,struct sk_buff * skb)740 static inline void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
741 struct sk_buff *skb)
742 {
743 }
744
xfrm_audit_state_replay(struct xfrm_state * x,struct sk_buff * skb,__be32 net_seq)745 static inline void xfrm_audit_state_replay(struct xfrm_state *x,
746 struct sk_buff *skb, __be32 net_seq)
747 {
748 }
749
xfrm_audit_state_notfound_simple(struct sk_buff * skb,u16 family)750 static inline void xfrm_audit_state_notfound_simple(struct sk_buff *skb,
751 u16 family)
752 {
753 }
754
xfrm_audit_state_notfound(struct sk_buff * skb,u16 family,__be32 net_spi,__be32 net_seq)755 static inline void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
756 __be32 net_spi, __be32 net_seq)
757 {
758 }
759
xfrm_audit_state_icvfail(struct xfrm_state * x,struct sk_buff * skb,u8 proto)760 static inline void xfrm_audit_state_icvfail(struct xfrm_state *x,
761 struct sk_buff *skb, u8 proto)
762 {
763 }
764 #endif /* CONFIG_AUDITSYSCALL */
765
xfrm_pol_hold(struct xfrm_policy * policy)766 static inline void xfrm_pol_hold(struct xfrm_policy *policy)
767 {
768 if (likely(policy != NULL))
769 refcount_inc(&policy->refcnt);
770 }
771
772 void xfrm_policy_destroy(struct xfrm_policy *policy);
773
xfrm_pol_put(struct xfrm_policy * policy)774 static inline void xfrm_pol_put(struct xfrm_policy *policy)
775 {
776 if (refcount_dec_and_test(&policy->refcnt))
777 xfrm_policy_destroy(policy);
778 }
779
xfrm_pols_put(struct xfrm_policy ** pols,int npols)780 static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols)
781 {
782 int i;
783 for (i = npols - 1; i >= 0; --i)
784 xfrm_pol_put(pols[i]);
785 }
786
787 void __xfrm_state_destroy(struct xfrm_state *, bool);
788
__xfrm_state_put(struct xfrm_state * x)789 static inline void __xfrm_state_put(struct xfrm_state *x)
790 {
791 refcount_dec(&x->refcnt);
792 }
793
xfrm_state_put(struct xfrm_state * x)794 static inline void xfrm_state_put(struct xfrm_state *x)
795 {
796 if (refcount_dec_and_test(&x->refcnt))
797 __xfrm_state_destroy(x, false);
798 }
799
xfrm_state_put_sync(struct xfrm_state * x)800 static inline void xfrm_state_put_sync(struct xfrm_state *x)
801 {
802 if (refcount_dec_and_test(&x->refcnt))
803 __xfrm_state_destroy(x, true);
804 }
805
xfrm_state_hold(struct xfrm_state * x)806 static inline void xfrm_state_hold(struct xfrm_state *x)
807 {
808 refcount_inc(&x->refcnt);
809 }
810
addr_match(const void * token1,const void * token2,unsigned int prefixlen)811 static inline bool addr_match(const void *token1, const void *token2,
812 unsigned int prefixlen)
813 {
814 const __be32 *a1 = token1;
815 const __be32 *a2 = token2;
816 unsigned int pdw;
817 unsigned int pbi;
818
819 pdw = prefixlen >> 5; /* num of whole u32 in prefix */
820 pbi = prefixlen & 0x1f; /* num of bits in incomplete u32 in prefix */
821
822 if (pdw)
823 if (memcmp(a1, a2, pdw << 2))
824 return false;
825
826 if (pbi) {
827 __be32 mask;
828
829 mask = htonl((0xffffffff) << (32 - pbi));
830
831 if ((a1[pdw] ^ a2[pdw]) & mask)
832 return false;
833 }
834
835 return true;
836 }
837
addr4_match(__be32 a1,__be32 a2,u8 prefixlen)838 static inline bool addr4_match(__be32 a1, __be32 a2, u8 prefixlen)
839 {
840 /* C99 6.5.7 (3): u32 << 32 is undefined behaviour */
841 if (sizeof(long) == 4 && prefixlen == 0)
842 return true;
843 return !((a1 ^ a2) & htonl(~0UL << (32 - prefixlen)));
844 }
845
846 static __inline__
xfrm_flowi_sport(const struct flowi * fl,const union flowi_uli * uli)847 __be16 xfrm_flowi_sport(const struct flowi *fl, const union flowi_uli *uli)
848 {
849 __be16 port;
850 switch(fl->flowi_proto) {
851 case IPPROTO_TCP:
852 case IPPROTO_UDP:
853 case IPPROTO_UDPLITE:
854 case IPPROTO_SCTP:
855 port = uli->ports.sport;
856 break;
857 case IPPROTO_ICMP:
858 case IPPROTO_ICMPV6:
859 port = htons(uli->icmpt.type);
860 break;
861 case IPPROTO_MH:
862 port = htons(uli->mht.type);
863 break;
864 case IPPROTO_GRE:
865 port = htons(ntohl(uli->gre_key) >> 16);
866 break;
867 default:
868 port = 0; /*XXX*/
869 }
870 return port;
871 }
872
873 static __inline__
xfrm_flowi_dport(const struct flowi * fl,const union flowi_uli * uli)874 __be16 xfrm_flowi_dport(const struct flowi *fl, const union flowi_uli *uli)
875 {
876 __be16 port;
877 switch(fl->flowi_proto) {
878 case IPPROTO_TCP:
879 case IPPROTO_UDP:
880 case IPPROTO_UDPLITE:
881 case IPPROTO_SCTP:
882 port = uli->ports.dport;
883 break;
884 case IPPROTO_ICMP:
885 case IPPROTO_ICMPV6:
886 port = htons(uli->icmpt.code);
887 break;
888 case IPPROTO_GRE:
889 port = htons(ntohl(uli->gre_key) & 0xffff);
890 break;
891 default:
892 port = 0; /*XXX*/
893 }
894 return port;
895 }
896
897 bool xfrm_selector_match(const struct xfrm_selector *sel,
898 const struct flowi *fl, unsigned short family);
899
900 #ifdef CONFIG_SECURITY_NETWORK_XFRM
901 /* If neither has a context --> match
902 * Otherwise, both must have a context and the sids, doi, alg must match
903 */
xfrm_sec_ctx_match(struct xfrm_sec_ctx * s1,struct xfrm_sec_ctx * s2)904 static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
905 {
906 return ((!s1 && !s2) ||
907 (s1 && s2 &&
908 (s1->ctx_sid == s2->ctx_sid) &&
909 (s1->ctx_doi == s2->ctx_doi) &&
910 (s1->ctx_alg == s2->ctx_alg)));
911 }
912 #else
xfrm_sec_ctx_match(struct xfrm_sec_ctx * s1,struct xfrm_sec_ctx * s2)913 static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
914 {
915 return true;
916 }
917 #endif
918
919 /* A struct encoding bundle of transformations to apply to some set of flow.
920 *
921 * xdst->child points to the next element of bundle.
922 * dst->xfrm points to an instanse of transformer.
923 *
924 * Due to unfortunate limitations of current routing cache, which we
925 * have no time to fix, it mirrors struct rtable and bound to the same
926 * routing key, including saddr,daddr. However, we can have many of
927 * bundles differing by session id. All the bundles grow from a parent
928 * policy rule.
929 */
930 struct xfrm_dst {
931 union {
932 struct dst_entry dst;
933 struct rtable rt;
934 struct rt6_info rt6;
935 } u;
936 struct dst_entry *route;
937 struct dst_entry *child;
938 struct dst_entry *path;
939 struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX];
940 int num_pols, num_xfrms;
941 u32 xfrm_genid;
942 u32 policy_genid;
943 u32 route_mtu_cached;
944 u32 child_mtu_cached;
945 u32 route_cookie;
946 u32 path_cookie;
947 };
948
xfrm_dst_path(const struct dst_entry * dst)949 static inline struct dst_entry *xfrm_dst_path(const struct dst_entry *dst)
950 {
951 #ifdef CONFIG_XFRM
952 if (dst->xfrm || (dst->flags & DST_XFRM_QUEUE)) {
953 const struct xfrm_dst *xdst = (const struct xfrm_dst *) dst;
954
955 return xdst->path;
956 }
957 #endif
958 return (struct dst_entry *) dst;
959 }
960
xfrm_dst_child(const struct dst_entry * dst)961 static inline struct dst_entry *xfrm_dst_child(const struct dst_entry *dst)
962 {
963 #ifdef CONFIG_XFRM
964 if (dst->xfrm || (dst->flags & DST_XFRM_QUEUE)) {
965 struct xfrm_dst *xdst = (struct xfrm_dst *) dst;
966 return xdst->child;
967 }
968 #endif
969 return NULL;
970 }
971
972 #ifdef CONFIG_XFRM
xfrm_dst_set_child(struct xfrm_dst * xdst,struct dst_entry * child)973 static inline void xfrm_dst_set_child(struct xfrm_dst *xdst, struct dst_entry *child)
974 {
975 xdst->child = child;
976 }
977
xfrm_dst_destroy(struct xfrm_dst * xdst)978 static inline void xfrm_dst_destroy(struct xfrm_dst *xdst)
979 {
980 xfrm_pols_put(xdst->pols, xdst->num_pols);
981 dst_release(xdst->route);
982 if (likely(xdst->u.dst.xfrm))
983 xfrm_state_put(xdst->u.dst.xfrm);
984 }
985 #endif
986
987 void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev);
988
989 struct xfrm_if_parms {
990 int link; /* ifindex of underlying L2 interface */
991 u32 if_id; /* interface identifyer */
992 };
993
994 struct xfrm_if {
995 struct xfrm_if __rcu *next; /* next interface in list */
996 struct net_device *dev; /* virtual device associated with interface */
997 struct net *net; /* netns for packet i/o */
998 struct xfrm_if_parms p; /* interface parms */
999
1000 struct gro_cells gro_cells;
1001 };
1002
1003 struct xfrm_offload {
1004 /* Output sequence number for replay protection on offloading. */
1005 struct {
1006 __u32 low;
1007 __u32 hi;
1008 } seq;
1009
1010 __u32 flags;
1011 #define SA_DELETE_REQ 1
1012 #define CRYPTO_DONE 2
1013 #define CRYPTO_NEXT_DONE 4
1014 #define CRYPTO_FALLBACK 8
1015 #define XFRM_GSO_SEGMENT 16
1016 #define XFRM_GRO 32
1017 #define XFRM_ESP_NO_TRAILER 64
1018 #define XFRM_DEV_RESUME 128
1019 #define XFRM_XMIT 256
1020
1021 __u32 status;
1022 #define CRYPTO_SUCCESS 1
1023 #define CRYPTO_GENERIC_ERROR 2
1024 #define CRYPTO_TRANSPORT_AH_AUTH_FAILED 4
1025 #define CRYPTO_TRANSPORT_ESP_AUTH_FAILED 8
1026 #define CRYPTO_TUNNEL_AH_AUTH_FAILED 16
1027 #define CRYPTO_TUNNEL_ESP_AUTH_FAILED 32
1028 #define CRYPTO_INVALID_PACKET_SYNTAX 64
1029 #define CRYPTO_INVALID_PROTOCOL 128
1030
1031 __u8 proto;
1032 };
1033
1034 struct sec_path {
1035 int len;
1036 int olen;
1037
1038 struct xfrm_state *xvec[XFRM_MAX_DEPTH];
1039 struct xfrm_offload ovec[XFRM_MAX_OFFLOAD_DEPTH];
1040 };
1041
1042 struct sec_path *secpath_set(struct sk_buff *skb);
1043
1044 static inline void
secpath_reset(struct sk_buff * skb)1045 secpath_reset(struct sk_buff *skb)
1046 {
1047 #ifdef CONFIG_XFRM
1048 skb_ext_del(skb, SKB_EXT_SEC_PATH);
1049 #endif
1050 }
1051
1052 static inline int
xfrm_addr_any(const xfrm_address_t * addr,unsigned short family)1053 xfrm_addr_any(const xfrm_address_t *addr, unsigned short family)
1054 {
1055 switch (family) {
1056 case AF_INET:
1057 return addr->a4 == 0;
1058 case AF_INET6:
1059 return ipv6_addr_any(&addr->in6);
1060 }
1061 return 0;
1062 }
1063
1064 static inline int
__xfrm4_state_addr_cmp(const struct xfrm_tmpl * tmpl,const struct xfrm_state * x)1065 __xfrm4_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x)
1066 {
1067 return (tmpl->saddr.a4 &&
1068 tmpl->saddr.a4 != x->props.saddr.a4);
1069 }
1070
1071 static inline int
__xfrm6_state_addr_cmp(const struct xfrm_tmpl * tmpl,const struct xfrm_state * x)1072 __xfrm6_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x)
1073 {
1074 return (!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) &&
1075 !ipv6_addr_equal((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr));
1076 }
1077
1078 static inline int
xfrm_state_addr_cmp(const struct xfrm_tmpl * tmpl,const struct xfrm_state * x,unsigned short family)1079 xfrm_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x, unsigned short family)
1080 {
1081 switch (family) {
1082 case AF_INET:
1083 return __xfrm4_state_addr_cmp(tmpl, x);
1084 case AF_INET6:
1085 return __xfrm6_state_addr_cmp(tmpl, x);
1086 }
1087 return !0;
1088 }
1089
1090 #ifdef CONFIG_XFRM
1091 int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb,
1092 unsigned short family);
1093
__xfrm_policy_check2(struct sock * sk,int dir,struct sk_buff * skb,unsigned int family,int reverse)1094 static inline int __xfrm_policy_check2(struct sock *sk, int dir,
1095 struct sk_buff *skb,
1096 unsigned int family, int reverse)
1097 {
1098 struct net *net = dev_net(skb->dev);
1099 int ndir = dir | (reverse ? XFRM_POLICY_MASK + 1 : 0);
1100
1101 if (sk && sk->sk_policy[XFRM_POLICY_IN])
1102 return __xfrm_policy_check(sk, ndir, skb, family);
1103
1104 return (!net->xfrm.policy_count[dir] && !secpath_exists(skb)) ||
1105 (skb_dst(skb) && (skb_dst(skb)->flags & DST_NOPOLICY)) ||
1106 __xfrm_policy_check(sk, ndir, skb, family);
1107 }
1108
xfrm_policy_check(struct sock * sk,int dir,struct sk_buff * skb,unsigned short family)1109 static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
1110 {
1111 return __xfrm_policy_check2(sk, dir, skb, family, 0);
1112 }
1113
xfrm4_policy_check(struct sock * sk,int dir,struct sk_buff * skb)1114 static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1115 {
1116 return xfrm_policy_check(sk, dir, skb, AF_INET);
1117 }
1118
xfrm6_policy_check(struct sock * sk,int dir,struct sk_buff * skb)1119 static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1120 {
1121 return xfrm_policy_check(sk, dir, skb, AF_INET6);
1122 }
1123
xfrm4_policy_check_reverse(struct sock * sk,int dir,struct sk_buff * skb)1124 static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
1125 struct sk_buff *skb)
1126 {
1127 return __xfrm_policy_check2(sk, dir, skb, AF_INET, 1);
1128 }
1129
xfrm6_policy_check_reverse(struct sock * sk,int dir,struct sk_buff * skb)1130 static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
1131 struct sk_buff *skb)
1132 {
1133 return __xfrm_policy_check2(sk, dir, skb, AF_INET6, 1);
1134 }
1135
1136 int __xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
1137 unsigned int family, int reverse);
1138
xfrm_decode_session(struct sk_buff * skb,struct flowi * fl,unsigned int family)1139 static inline int xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
1140 unsigned int family)
1141 {
1142 return __xfrm_decode_session(skb, fl, family, 0);
1143 }
1144
xfrm_decode_session_reverse(struct sk_buff * skb,struct flowi * fl,unsigned int family)1145 static inline int xfrm_decode_session_reverse(struct sk_buff *skb,
1146 struct flowi *fl,
1147 unsigned int family)
1148 {
1149 return __xfrm_decode_session(skb, fl, family, 1);
1150 }
1151
1152 int __xfrm_route_forward(struct sk_buff *skb, unsigned short family);
1153
xfrm_route_forward(struct sk_buff * skb,unsigned short family)1154 static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family)
1155 {
1156 struct net *net = dev_net(skb->dev);
1157
1158 return !net->xfrm.policy_count[XFRM_POLICY_OUT] ||
1159 (skb_dst(skb)->flags & DST_NOXFRM) ||
1160 __xfrm_route_forward(skb, family);
1161 }
1162
xfrm4_route_forward(struct sk_buff * skb)1163 static inline int xfrm4_route_forward(struct sk_buff *skb)
1164 {
1165 return xfrm_route_forward(skb, AF_INET);
1166 }
1167
xfrm6_route_forward(struct sk_buff * skb)1168 static inline int xfrm6_route_forward(struct sk_buff *skb)
1169 {
1170 return xfrm_route_forward(skb, AF_INET6);
1171 }
1172
1173 int __xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk);
1174
xfrm_sk_clone_policy(struct sock * sk,const struct sock * osk)1175 static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk)
1176 {
1177 sk->sk_policy[0] = NULL;
1178 sk->sk_policy[1] = NULL;
1179 if (unlikely(osk->sk_policy[0] || osk->sk_policy[1]))
1180 return __xfrm_sk_clone_policy(sk, osk);
1181 return 0;
1182 }
1183
1184 int xfrm_policy_delete(struct xfrm_policy *pol, int dir);
1185
xfrm_sk_free_policy(struct sock * sk)1186 static inline void xfrm_sk_free_policy(struct sock *sk)
1187 {
1188 struct xfrm_policy *pol;
1189
1190 pol = rcu_dereference_protected(sk->sk_policy[0], 1);
1191 if (unlikely(pol != NULL)) {
1192 xfrm_policy_delete(pol, XFRM_POLICY_MAX);
1193 sk->sk_policy[0] = NULL;
1194 }
1195 pol = rcu_dereference_protected(sk->sk_policy[1], 1);
1196 if (unlikely(pol != NULL)) {
1197 xfrm_policy_delete(pol, XFRM_POLICY_MAX+1);
1198 sk->sk_policy[1] = NULL;
1199 }
1200 }
1201
1202 #else
1203
xfrm_sk_free_policy(struct sock * sk)1204 static inline void xfrm_sk_free_policy(struct sock *sk) {}
xfrm_sk_clone_policy(struct sock * sk,const struct sock * osk)1205 static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk) { return 0; }
xfrm6_route_forward(struct sk_buff * skb)1206 static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; }
xfrm4_route_forward(struct sk_buff * skb)1207 static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; }
xfrm6_policy_check(struct sock * sk,int dir,struct sk_buff * skb)1208 static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1209 {
1210 return 1;
1211 }
xfrm4_policy_check(struct sock * sk,int dir,struct sk_buff * skb)1212 static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1213 {
1214 return 1;
1215 }
xfrm_policy_check(struct sock * sk,int dir,struct sk_buff * skb,unsigned short family)1216 static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
1217 {
1218 return 1;
1219 }
xfrm_decode_session_reverse(struct sk_buff * skb,struct flowi * fl,unsigned int family)1220 static inline int xfrm_decode_session_reverse(struct sk_buff *skb,
1221 struct flowi *fl,
1222 unsigned int family)
1223 {
1224 return -ENOSYS;
1225 }
xfrm4_policy_check_reverse(struct sock * sk,int dir,struct sk_buff * skb)1226 static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
1227 struct sk_buff *skb)
1228 {
1229 return 1;
1230 }
xfrm6_policy_check_reverse(struct sock * sk,int dir,struct sk_buff * skb)1231 static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
1232 struct sk_buff *skb)
1233 {
1234 return 1;
1235 }
1236 #endif
1237
1238 static __inline__
xfrm_flowi_daddr(const struct flowi * fl,unsigned short family)1239 xfrm_address_t *xfrm_flowi_daddr(const struct flowi *fl, unsigned short family)
1240 {
1241 switch (family){
1242 case AF_INET:
1243 return (xfrm_address_t *)&fl->u.ip4.daddr;
1244 case AF_INET6:
1245 return (xfrm_address_t *)&fl->u.ip6.daddr;
1246 }
1247 return NULL;
1248 }
1249
1250 static __inline__
xfrm_flowi_saddr(const struct flowi * fl,unsigned short family)1251 xfrm_address_t *xfrm_flowi_saddr(const struct flowi *fl, unsigned short family)
1252 {
1253 switch (family){
1254 case AF_INET:
1255 return (xfrm_address_t *)&fl->u.ip4.saddr;
1256 case AF_INET6:
1257 return (xfrm_address_t *)&fl->u.ip6.saddr;
1258 }
1259 return NULL;
1260 }
1261
1262 static __inline__
xfrm_flowi_addr_get(const struct flowi * fl,xfrm_address_t * saddr,xfrm_address_t * daddr,unsigned short family)1263 void xfrm_flowi_addr_get(const struct flowi *fl,
1264 xfrm_address_t *saddr, xfrm_address_t *daddr,
1265 unsigned short family)
1266 {
1267 switch(family) {
1268 case AF_INET:
1269 memcpy(&saddr->a4, &fl->u.ip4.saddr, sizeof(saddr->a4));
1270 memcpy(&daddr->a4, &fl->u.ip4.daddr, sizeof(daddr->a4));
1271 break;
1272 case AF_INET6:
1273 saddr->in6 = fl->u.ip6.saddr;
1274 daddr->in6 = fl->u.ip6.daddr;
1275 break;
1276 }
1277 }
1278
1279 static __inline__ int
__xfrm4_state_addr_check(const struct xfrm_state * x,const xfrm_address_t * daddr,const xfrm_address_t * saddr)1280 __xfrm4_state_addr_check(const struct xfrm_state *x,
1281 const xfrm_address_t *daddr, const xfrm_address_t *saddr)
1282 {
1283 if (daddr->a4 == x->id.daddr.a4 &&
1284 (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4))
1285 return 1;
1286 return 0;
1287 }
1288
1289 static __inline__ int
__xfrm6_state_addr_check(const struct xfrm_state * x,const xfrm_address_t * daddr,const xfrm_address_t * saddr)1290 __xfrm6_state_addr_check(const struct xfrm_state *x,
1291 const xfrm_address_t *daddr, const xfrm_address_t *saddr)
1292 {
1293 if (ipv6_addr_equal((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) &&
1294 (ipv6_addr_equal((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr) ||
1295 ipv6_addr_any((struct in6_addr *)saddr) ||
1296 ipv6_addr_any((struct in6_addr *)&x->props.saddr)))
1297 return 1;
1298 return 0;
1299 }
1300
1301 static __inline__ int
xfrm_state_addr_check(const struct xfrm_state * x,const xfrm_address_t * daddr,const xfrm_address_t * saddr,unsigned short family)1302 xfrm_state_addr_check(const struct xfrm_state *x,
1303 const xfrm_address_t *daddr, const xfrm_address_t *saddr,
1304 unsigned short family)
1305 {
1306 switch (family) {
1307 case AF_INET:
1308 return __xfrm4_state_addr_check(x, daddr, saddr);
1309 case AF_INET6:
1310 return __xfrm6_state_addr_check(x, daddr, saddr);
1311 }
1312 return 0;
1313 }
1314
1315 static __inline__ int
xfrm_state_addr_flow_check(const struct xfrm_state * x,const struct flowi * fl,unsigned short family)1316 xfrm_state_addr_flow_check(const struct xfrm_state *x, const struct flowi *fl,
1317 unsigned short family)
1318 {
1319 switch (family) {
1320 case AF_INET:
1321 return __xfrm4_state_addr_check(x,
1322 (const xfrm_address_t *)&fl->u.ip4.daddr,
1323 (const xfrm_address_t *)&fl->u.ip4.saddr);
1324 case AF_INET6:
1325 return __xfrm6_state_addr_check(x,
1326 (const xfrm_address_t *)&fl->u.ip6.daddr,
1327 (const xfrm_address_t *)&fl->u.ip6.saddr);
1328 }
1329 return 0;
1330 }
1331
xfrm_state_kern(const struct xfrm_state * x)1332 static inline int xfrm_state_kern(const struct xfrm_state *x)
1333 {
1334 return atomic_read(&x->tunnel_users);
1335 }
1336
xfrm_id_proto_valid(u8 proto)1337 static inline bool xfrm_id_proto_valid(u8 proto)
1338 {
1339 switch (proto) {
1340 case IPPROTO_AH:
1341 case IPPROTO_ESP:
1342 case IPPROTO_COMP:
1343 #if IS_ENABLED(CONFIG_IPV6)
1344 case IPPROTO_ROUTING:
1345 case IPPROTO_DSTOPTS:
1346 #endif
1347 return true;
1348 default:
1349 return false;
1350 }
1351 }
1352
1353 /* IPSEC_PROTO_ANY only matches 3 IPsec protocols, 0 could match all. */
xfrm_id_proto_match(u8 proto,u8 userproto)1354 static inline int xfrm_id_proto_match(u8 proto, u8 userproto)
1355 {
1356 return (!userproto || proto == userproto ||
1357 (userproto == IPSEC_PROTO_ANY && (proto == IPPROTO_AH ||
1358 proto == IPPROTO_ESP ||
1359 proto == IPPROTO_COMP)));
1360 }
1361
1362 /*
1363 * xfrm algorithm information
1364 */
1365 struct xfrm_algo_aead_info {
1366 char *geniv;
1367 u16 icv_truncbits;
1368 };
1369
1370 struct xfrm_algo_auth_info {
1371 u16 icv_truncbits;
1372 u16 icv_fullbits;
1373 };
1374
1375 struct xfrm_algo_encr_info {
1376 char *geniv;
1377 u16 blockbits;
1378 u16 defkeybits;
1379 };
1380
1381 struct xfrm_algo_comp_info {
1382 u16 threshold;
1383 };
1384
1385 struct xfrm_algo_desc {
1386 char *name;
1387 char *compat;
1388 u8 available:1;
1389 u8 pfkey_supported:1;
1390 union {
1391 struct xfrm_algo_aead_info aead;
1392 struct xfrm_algo_auth_info auth;
1393 struct xfrm_algo_encr_info encr;
1394 struct xfrm_algo_comp_info comp;
1395 } uinfo;
1396 struct sadb_alg desc;
1397 };
1398
1399 /* XFRM protocol handlers. */
1400 struct xfrm4_protocol {
1401 int (*handler)(struct sk_buff *skb);
1402 int (*input_handler)(struct sk_buff *skb, int nexthdr, __be32 spi,
1403 int encap_type);
1404 int (*cb_handler)(struct sk_buff *skb, int err);
1405 int (*err_handler)(struct sk_buff *skb, u32 info);
1406
1407 struct xfrm4_protocol __rcu *next;
1408 int priority;
1409 };
1410
1411 struct xfrm6_protocol {
1412 int (*handler)(struct sk_buff *skb);
1413 int (*input_handler)(struct sk_buff *skb, int nexthdr, __be32 spi,
1414 int encap_type);
1415 int (*cb_handler)(struct sk_buff *skb, int err);
1416 int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
1417 u8 type, u8 code, int offset, __be32 info);
1418
1419 struct xfrm6_protocol __rcu *next;
1420 int priority;
1421 };
1422
1423 /* XFRM tunnel handlers. */
1424 struct xfrm_tunnel {
1425 int (*handler)(struct sk_buff *skb);
1426 int (*cb_handler)(struct sk_buff *skb, int err);
1427 int (*err_handler)(struct sk_buff *skb, u32 info);
1428
1429 struct xfrm_tunnel __rcu *next;
1430 int priority;
1431 };
1432
1433 struct xfrm6_tunnel {
1434 int (*handler)(struct sk_buff *skb);
1435 int (*cb_handler)(struct sk_buff *skb, int err);
1436 int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
1437 u8 type, u8 code, int offset, __be32 info);
1438 struct xfrm6_tunnel __rcu *next;
1439 int priority;
1440 };
1441
1442 void xfrm_init(void);
1443 void xfrm4_init(void);
1444 int xfrm_state_init(struct net *net);
1445 void xfrm_state_fini(struct net *net);
1446 void xfrm4_state_init(void);
1447 void xfrm4_protocol_init(void);
1448 #ifdef CONFIG_XFRM
1449 int xfrm6_init(void);
1450 void xfrm6_fini(void);
1451 int xfrm6_state_init(void);
1452 void xfrm6_state_fini(void);
1453 int xfrm6_protocol_init(void);
1454 void xfrm6_protocol_fini(void);
1455 #else
xfrm6_init(void)1456 static inline int xfrm6_init(void)
1457 {
1458 return 0;
1459 }
xfrm6_fini(void)1460 static inline void xfrm6_fini(void)
1461 {
1462 ;
1463 }
1464 #endif
1465
1466 #ifdef CONFIG_XFRM_STATISTICS
1467 int xfrm_proc_init(struct net *net);
1468 void xfrm_proc_fini(struct net *net);
1469 #endif
1470
1471 int xfrm_sysctl_init(struct net *net);
1472 #ifdef CONFIG_SYSCTL
1473 void xfrm_sysctl_fini(struct net *net);
1474 #else
xfrm_sysctl_fini(struct net * net)1475 static inline void xfrm_sysctl_fini(struct net *net)
1476 {
1477 }
1478 #endif
1479
1480 void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto,
1481 struct xfrm_address_filter *filter);
1482 int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk,
1483 int (*func)(struct xfrm_state *, int, void*), void *);
1484 void xfrm_state_walk_done(struct xfrm_state_walk *walk, struct net *net);
1485 struct xfrm_state *xfrm_state_alloc(struct net *net);
1486 void xfrm_state_free(struct xfrm_state *x);
1487 struct xfrm_state *xfrm_state_find(const xfrm_address_t *daddr,
1488 const xfrm_address_t *saddr,
1489 const struct flowi *fl,
1490 struct xfrm_tmpl *tmpl,
1491 struct xfrm_policy *pol, int *err,
1492 unsigned short family, u32 if_id);
1493 struct xfrm_state *xfrm_stateonly_find(struct net *net, u32 mark, u32 if_id,
1494 xfrm_address_t *daddr,
1495 xfrm_address_t *saddr,
1496 unsigned short family,
1497 u8 mode, u8 proto, u32 reqid);
1498 struct xfrm_state *xfrm_state_lookup_byspi(struct net *net, __be32 spi,
1499 unsigned short family);
1500 int xfrm_state_check_expire(struct xfrm_state *x);
1501 void xfrm_state_insert(struct xfrm_state *x);
1502 int xfrm_state_add(struct xfrm_state *x);
1503 int xfrm_state_update(struct xfrm_state *x);
1504 struct xfrm_state *xfrm_state_lookup(struct net *net, u32 mark,
1505 const xfrm_address_t *daddr, __be32 spi,
1506 u8 proto, unsigned short family);
1507 struct xfrm_state *xfrm_state_lookup_byaddr(struct net *net, u32 mark,
1508 const xfrm_address_t *daddr,
1509 const xfrm_address_t *saddr,
1510 u8 proto,
1511 unsigned short family);
1512 #ifdef CONFIG_XFRM_SUB_POLICY
1513 void xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n,
1514 unsigned short family);
1515 void xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n,
1516 unsigned short family);
1517 #else
xfrm_tmpl_sort(struct xfrm_tmpl ** d,struct xfrm_tmpl ** s,int n,unsigned short family)1518 static inline void xfrm_tmpl_sort(struct xfrm_tmpl **d, struct xfrm_tmpl **s,
1519 int n, unsigned short family)
1520 {
1521 }
1522
xfrm_state_sort(struct xfrm_state ** d,struct xfrm_state ** s,int n,unsigned short family)1523 static inline void xfrm_state_sort(struct xfrm_state **d, struct xfrm_state **s,
1524 int n, unsigned short family)
1525 {
1526 }
1527 #endif
1528
1529 struct xfrmk_sadinfo {
1530 u32 sadhcnt; /* current hash bkts */
1531 u32 sadhmcnt; /* max allowed hash bkts */
1532 u32 sadcnt; /* current running count */
1533 };
1534
1535 struct xfrmk_spdinfo {
1536 u32 incnt;
1537 u32 outcnt;
1538 u32 fwdcnt;
1539 u32 inscnt;
1540 u32 outscnt;
1541 u32 fwdscnt;
1542 u32 spdhcnt;
1543 u32 spdhmcnt;
1544 };
1545
1546 struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq);
1547 int xfrm_state_delete(struct xfrm_state *x);
1548 int xfrm_state_flush(struct net *net, u8 proto, bool task_valid, bool sync);
1549 int xfrm_dev_state_flush(struct net *net, struct net_device *dev, bool task_valid);
1550 void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si);
1551 void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si);
1552 u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq);
1553 int xfrm_init_replay(struct xfrm_state *x);
1554 u32 __xfrm_state_mtu(struct xfrm_state *x, int mtu);
1555 u32 xfrm_state_mtu(struct xfrm_state *x, int mtu);
1556 int __xfrm_init_state(struct xfrm_state *x, bool init_replay, bool offload);
1557 int xfrm_init_state(struct xfrm_state *x);
1558 int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type);
1559 int xfrm_input_resume(struct sk_buff *skb, int nexthdr);
1560 int xfrm_trans_queue_net(struct net *net, struct sk_buff *skb,
1561 int (*finish)(struct net *, struct sock *,
1562 struct sk_buff *));
1563 int xfrm_trans_queue(struct sk_buff *skb,
1564 int (*finish)(struct net *, struct sock *,
1565 struct sk_buff *));
1566 int xfrm_output_resume(struct sock *sk, struct sk_buff *skb, int err);
1567 int xfrm_output(struct sock *sk, struct sk_buff *skb);
1568
1569 #if IS_ENABLED(CONFIG_NET_PKTGEN)
1570 int pktgen_xfrm_outer_mode_output(struct xfrm_state *x, struct sk_buff *skb);
1571 #endif
1572
1573 void xfrm_local_error(struct sk_buff *skb, int mtu);
1574 int xfrm4_extract_input(struct xfrm_state *x, struct sk_buff *skb);
1575 int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi,
1576 int encap_type);
1577 int xfrm4_transport_finish(struct sk_buff *skb, int async);
1578 int xfrm4_rcv(struct sk_buff *skb);
1579 int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq);
1580
xfrm4_rcv_spi(struct sk_buff * skb,int nexthdr,__be32 spi)1581 static inline int xfrm4_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi)
1582 {
1583 XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL;
1584 XFRM_SPI_SKB_CB(skb)->family = AF_INET;
1585 XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr);
1586 return xfrm_input(skb, nexthdr, spi, 0);
1587 }
1588
1589 int xfrm4_output(struct net *net, struct sock *sk, struct sk_buff *skb);
1590 int xfrm4_output_finish(struct sock *sk, struct sk_buff *skb);
1591 int xfrm4_protocol_register(struct xfrm4_protocol *handler, unsigned char protocol);
1592 int xfrm4_protocol_deregister(struct xfrm4_protocol *handler, unsigned char protocol);
1593 int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family);
1594 int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family);
1595 void xfrm4_local_error(struct sk_buff *skb, u32 mtu);
1596 int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb);
1597 int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi,
1598 struct ip6_tnl *t);
1599 int xfrm6_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi,
1600 int encap_type);
1601 int xfrm6_transport_finish(struct sk_buff *skb, int async);
1602 int xfrm6_rcv_tnl(struct sk_buff *skb, struct ip6_tnl *t);
1603 int xfrm6_rcv(struct sk_buff *skb);
1604 int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
1605 xfrm_address_t *saddr, u8 proto);
1606 void xfrm6_local_error(struct sk_buff *skb, u32 mtu);
1607 int xfrm6_protocol_register(struct xfrm6_protocol *handler, unsigned char protocol);
1608 int xfrm6_protocol_deregister(struct xfrm6_protocol *handler, unsigned char protocol);
1609 int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family);
1610 int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family);
1611 __be32 xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr);
1612 __be32 xfrm6_tunnel_spi_lookup(struct net *net, const xfrm_address_t *saddr);
1613 int xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb);
1614 int xfrm6_output_finish(struct sock *sk, struct sk_buff *skb);
1615 int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb,
1616 u8 **prevhdr);
1617
1618 #ifdef CONFIG_XFRM
1619 void xfrm6_local_rxpmtu(struct sk_buff *skb, u32 mtu);
1620 int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb);
1621 int xfrm6_udp_encap_rcv(struct sock *sk, struct sk_buff *skb);
1622 int xfrm_user_policy(struct sock *sk, int optname, sockptr_t optval,
1623 int optlen);
1624 #else
xfrm_user_policy(struct sock * sk,int optname,sockptr_t optval,int optlen)1625 static inline int xfrm_user_policy(struct sock *sk, int optname,
1626 sockptr_t optval, int optlen)
1627 {
1628 return -ENOPROTOOPT;
1629 }
1630 #endif
1631
1632 struct dst_entry *__xfrm_dst_lookup(struct net *net, int tos, int oif,
1633 const xfrm_address_t *saddr,
1634 const xfrm_address_t *daddr,
1635 int family, u32 mark);
1636
1637 struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp);
1638
1639 void xfrm_policy_walk_init(struct xfrm_policy_walk *walk, u8 type);
1640 int xfrm_policy_walk(struct net *net, struct xfrm_policy_walk *walk,
1641 int (*func)(struct xfrm_policy *, int, int, void*),
1642 void *);
1643 void xfrm_policy_walk_done(struct xfrm_policy_walk *walk, struct net *net);
1644 int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl);
1645 struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net,
1646 const struct xfrm_mark *mark,
1647 u32 if_id, u8 type, int dir,
1648 struct xfrm_selector *sel,
1649 struct xfrm_sec_ctx *ctx, int delete,
1650 int *err);
1651 struct xfrm_policy *xfrm_policy_byid(struct net *net,
1652 const struct xfrm_mark *mark, u32 if_id,
1653 u8 type, int dir, u32 id, int delete,
1654 int *err);
1655 int xfrm_policy_flush(struct net *net, u8 type, bool task_valid);
1656 void xfrm_policy_hash_rebuild(struct net *net);
1657 u32 xfrm_get_acqseq(void);
1658 int verify_spi_info(u8 proto, u32 min, u32 max);
1659 int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi);
1660 struct xfrm_state *xfrm_find_acq(struct net *net, const struct xfrm_mark *mark,
1661 u8 mode, u32 reqid, u32 if_id, u8 proto,
1662 const xfrm_address_t *daddr,
1663 const xfrm_address_t *saddr, int create,
1664 unsigned short family);
1665 int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol);
1666
1667 #ifdef CONFIG_XFRM_MIGRATE
1668 int km_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
1669 const struct xfrm_migrate *m, int num_bundles,
1670 const struct xfrm_kmaddress *k,
1671 const struct xfrm_encap_tmpl *encap);
1672 struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net);
1673 struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x,
1674 struct xfrm_migrate *m,
1675 struct xfrm_encap_tmpl *encap);
1676 int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
1677 struct xfrm_migrate *m, int num_bundles,
1678 struct xfrm_kmaddress *k, struct net *net,
1679 struct xfrm_encap_tmpl *encap);
1680 #endif
1681
1682 int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
1683 void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 portid);
1684 int km_report(struct net *net, u8 proto, struct xfrm_selector *sel,
1685 xfrm_address_t *addr);
1686
1687 void xfrm_input_init(void);
1688 int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq);
1689
1690 void xfrm_probe_algs(void);
1691 int xfrm_count_pfkey_auth_supported(void);
1692 int xfrm_count_pfkey_enc_supported(void);
1693 struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx);
1694 struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx);
1695 struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id);
1696 struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id);
1697 struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id);
1698 struct xfrm_algo_desc *xfrm_aalg_get_byname(const char *name, int probe);
1699 struct xfrm_algo_desc *xfrm_ealg_get_byname(const char *name, int probe);
1700 struct xfrm_algo_desc *xfrm_calg_get_byname(const char *name, int probe);
1701 struct xfrm_algo_desc *xfrm_aead_get_byname(const char *name, int icv_len,
1702 int probe);
1703
xfrm6_addr_equal(const xfrm_address_t * a,const xfrm_address_t * b)1704 static inline bool xfrm6_addr_equal(const xfrm_address_t *a,
1705 const xfrm_address_t *b)
1706 {
1707 return ipv6_addr_equal((const struct in6_addr *)a,
1708 (const struct in6_addr *)b);
1709 }
1710
xfrm_addr_equal(const xfrm_address_t * a,const xfrm_address_t * b,sa_family_t family)1711 static inline bool xfrm_addr_equal(const xfrm_address_t *a,
1712 const xfrm_address_t *b,
1713 sa_family_t family)
1714 {
1715 switch (family) {
1716 default:
1717 case AF_INET:
1718 return ((__force u32)a->a4 ^ (__force u32)b->a4) == 0;
1719 case AF_INET6:
1720 return xfrm6_addr_equal(a, b);
1721 }
1722 }
1723
xfrm_policy_id2dir(u32 index)1724 static inline int xfrm_policy_id2dir(u32 index)
1725 {
1726 return index & 7;
1727 }
1728
1729 #ifdef CONFIG_XFRM
xfrm_aevent_is_on(struct net * net)1730 static inline int xfrm_aevent_is_on(struct net *net)
1731 {
1732 struct sock *nlsk;
1733 int ret = 0;
1734
1735 rcu_read_lock();
1736 nlsk = rcu_dereference(net->xfrm.nlsk);
1737 if (nlsk)
1738 ret = netlink_has_listeners(nlsk, XFRMNLGRP_AEVENTS);
1739 rcu_read_unlock();
1740 return ret;
1741 }
1742
xfrm_acquire_is_on(struct net * net)1743 static inline int xfrm_acquire_is_on(struct net *net)
1744 {
1745 struct sock *nlsk;
1746 int ret = 0;
1747
1748 rcu_read_lock();
1749 nlsk = rcu_dereference(net->xfrm.nlsk);
1750 if (nlsk)
1751 ret = netlink_has_listeners(nlsk, XFRMNLGRP_ACQUIRE);
1752 rcu_read_unlock();
1753
1754 return ret;
1755 }
1756 #endif
1757
aead_len(struct xfrm_algo_aead * alg)1758 static inline unsigned int aead_len(struct xfrm_algo_aead *alg)
1759 {
1760 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1761 }
1762
xfrm_alg_len(const struct xfrm_algo * alg)1763 static inline unsigned int xfrm_alg_len(const struct xfrm_algo *alg)
1764 {
1765 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1766 }
1767
xfrm_alg_auth_len(const struct xfrm_algo_auth * alg)1768 static inline unsigned int xfrm_alg_auth_len(const struct xfrm_algo_auth *alg)
1769 {
1770 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1771 }
1772
xfrm_replay_state_esn_len(struct xfrm_replay_state_esn * replay_esn)1773 static inline unsigned int xfrm_replay_state_esn_len(struct xfrm_replay_state_esn *replay_esn)
1774 {
1775 return sizeof(*replay_esn) + replay_esn->bmp_len * sizeof(__u32);
1776 }
1777
1778 #ifdef CONFIG_XFRM_MIGRATE
xfrm_replay_clone(struct xfrm_state * x,struct xfrm_state * orig)1779 static inline int xfrm_replay_clone(struct xfrm_state *x,
1780 struct xfrm_state *orig)
1781 {
1782
1783 x->replay_esn = kmemdup(orig->replay_esn,
1784 xfrm_replay_state_esn_len(orig->replay_esn),
1785 GFP_KERNEL);
1786 if (!x->replay_esn)
1787 return -ENOMEM;
1788 x->preplay_esn = kmemdup(orig->preplay_esn,
1789 xfrm_replay_state_esn_len(orig->preplay_esn),
1790 GFP_KERNEL);
1791 if (!x->preplay_esn)
1792 return -ENOMEM;
1793
1794 return 0;
1795 }
1796
xfrm_algo_aead_clone(struct xfrm_algo_aead * orig)1797 static inline struct xfrm_algo_aead *xfrm_algo_aead_clone(struct xfrm_algo_aead *orig)
1798 {
1799 return kmemdup(orig, aead_len(orig), GFP_KERNEL);
1800 }
1801
1802
xfrm_algo_clone(struct xfrm_algo * orig)1803 static inline struct xfrm_algo *xfrm_algo_clone(struct xfrm_algo *orig)
1804 {
1805 return kmemdup(orig, xfrm_alg_len(orig), GFP_KERNEL);
1806 }
1807
xfrm_algo_auth_clone(struct xfrm_algo_auth * orig)1808 static inline struct xfrm_algo_auth *xfrm_algo_auth_clone(struct xfrm_algo_auth *orig)
1809 {
1810 return kmemdup(orig, xfrm_alg_auth_len(orig), GFP_KERNEL);
1811 }
1812
xfrm_states_put(struct xfrm_state ** states,int n)1813 static inline void xfrm_states_put(struct xfrm_state **states, int n)
1814 {
1815 int i;
1816 for (i = 0; i < n; i++)
1817 xfrm_state_put(*(states + i));
1818 }
1819
xfrm_states_delete(struct xfrm_state ** states,int n)1820 static inline void xfrm_states_delete(struct xfrm_state **states, int n)
1821 {
1822 int i;
1823 for (i = 0; i < n; i++)
1824 xfrm_state_delete(*(states + i));
1825 }
1826 #endif
1827
1828 #ifdef CONFIG_XFRM
xfrm_input_state(struct sk_buff * skb)1829 static inline struct xfrm_state *xfrm_input_state(struct sk_buff *skb)
1830 {
1831 struct sec_path *sp = skb_sec_path(skb);
1832
1833 return sp->xvec[sp->len - 1];
1834 }
1835 #endif
1836
xfrm_offload(struct sk_buff * skb)1837 static inline struct xfrm_offload *xfrm_offload(struct sk_buff *skb)
1838 {
1839 #ifdef CONFIG_XFRM
1840 struct sec_path *sp = skb_sec_path(skb);
1841
1842 if (!sp || !sp->olen || sp->len != sp->olen)
1843 return NULL;
1844
1845 return &sp->ovec[sp->olen - 1];
1846 #else
1847 return NULL;
1848 #endif
1849 }
1850
1851 void __init xfrm_dev_init(void);
1852
1853 #ifdef CONFIG_XFRM_OFFLOAD
1854 void xfrm_dev_resume(struct sk_buff *skb);
1855 void xfrm_dev_backlog(struct softnet_data *sd);
1856 struct sk_buff *validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t features, bool *again);
1857 int xfrm_dev_state_add(struct net *net, struct xfrm_state *x,
1858 struct xfrm_user_offload *xuo);
1859 bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x);
1860
xfrm_dev_state_advance_esn(struct xfrm_state * x)1861 static inline void xfrm_dev_state_advance_esn(struct xfrm_state *x)
1862 {
1863 struct xfrm_state_offload *xso = &x->xso;
1864
1865 if (xso->dev && xso->dev->xfrmdev_ops->xdo_dev_state_advance_esn)
1866 xso->dev->xfrmdev_ops->xdo_dev_state_advance_esn(x);
1867 }
1868
xfrm_dst_offload_ok(struct dst_entry * dst)1869 static inline bool xfrm_dst_offload_ok(struct dst_entry *dst)
1870 {
1871 struct xfrm_state *x = dst->xfrm;
1872 struct xfrm_dst *xdst;
1873
1874 if (!x || !x->type_offload)
1875 return false;
1876
1877 xdst = (struct xfrm_dst *) dst;
1878 if (!x->xso.offload_handle && !xdst->child->xfrm)
1879 return true;
1880 if (x->xso.offload_handle && (x->xso.dev == xfrm_dst_path(dst)->dev) &&
1881 !xdst->child->xfrm)
1882 return true;
1883
1884 return false;
1885 }
1886
xfrm_dev_state_delete(struct xfrm_state * x)1887 static inline void xfrm_dev_state_delete(struct xfrm_state *x)
1888 {
1889 struct xfrm_state_offload *xso = &x->xso;
1890
1891 if (xso->dev)
1892 xso->dev->xfrmdev_ops->xdo_dev_state_delete(x);
1893 }
1894
xfrm_dev_state_free(struct xfrm_state * x)1895 static inline void xfrm_dev_state_free(struct xfrm_state *x)
1896 {
1897 struct xfrm_state_offload *xso = &x->xso;
1898 struct net_device *dev = xso->dev;
1899
1900 if (dev && dev->xfrmdev_ops) {
1901 if (dev->xfrmdev_ops->xdo_dev_state_free)
1902 dev->xfrmdev_ops->xdo_dev_state_free(x);
1903 xso->dev = NULL;
1904 dev_put(dev);
1905 }
1906 }
1907 #else
xfrm_dev_resume(struct sk_buff * skb)1908 static inline void xfrm_dev_resume(struct sk_buff *skb)
1909 {
1910 }
1911
xfrm_dev_backlog(struct softnet_data * sd)1912 static inline void xfrm_dev_backlog(struct softnet_data *sd)
1913 {
1914 }
1915
validate_xmit_xfrm(struct sk_buff * skb,netdev_features_t features,bool * again)1916 static inline struct sk_buff *validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t features, bool *again)
1917 {
1918 return skb;
1919 }
1920
xfrm_dev_state_add(struct net * net,struct xfrm_state * x,struct xfrm_user_offload * xuo)1921 static inline int xfrm_dev_state_add(struct net *net, struct xfrm_state *x, struct xfrm_user_offload *xuo)
1922 {
1923 return 0;
1924 }
1925
xfrm_dev_state_delete(struct xfrm_state * x)1926 static inline void xfrm_dev_state_delete(struct xfrm_state *x)
1927 {
1928 }
1929
xfrm_dev_state_free(struct xfrm_state * x)1930 static inline void xfrm_dev_state_free(struct xfrm_state *x)
1931 {
1932 }
1933
xfrm_dev_offload_ok(struct sk_buff * skb,struct xfrm_state * x)1934 static inline bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x)
1935 {
1936 return false;
1937 }
1938
xfrm_dev_state_advance_esn(struct xfrm_state * x)1939 static inline void xfrm_dev_state_advance_esn(struct xfrm_state *x)
1940 {
1941 }
1942
xfrm_dst_offload_ok(struct dst_entry * dst)1943 static inline bool xfrm_dst_offload_ok(struct dst_entry *dst)
1944 {
1945 return false;
1946 }
1947 #endif
1948
xfrm_mark_get(struct nlattr ** attrs,struct xfrm_mark * m)1949 static inline int xfrm_mark_get(struct nlattr **attrs, struct xfrm_mark *m)
1950 {
1951 if (attrs[XFRMA_MARK])
1952 memcpy(m, nla_data(attrs[XFRMA_MARK]), sizeof(struct xfrm_mark));
1953 else
1954 m->v = m->m = 0;
1955
1956 return m->v & m->m;
1957 }
1958
xfrm_mark_put(struct sk_buff * skb,const struct xfrm_mark * m)1959 static inline int xfrm_mark_put(struct sk_buff *skb, const struct xfrm_mark *m)
1960 {
1961 int ret = 0;
1962
1963 if (m->m | m->v)
1964 ret = nla_put(skb, XFRMA_MARK, sizeof(struct xfrm_mark), m);
1965 return ret;
1966 }
1967
xfrm_smark_get(__u32 mark,struct xfrm_state * x)1968 static inline __u32 xfrm_smark_get(__u32 mark, struct xfrm_state *x)
1969 {
1970 struct xfrm_mark *m = &x->props.smark;
1971
1972 return (m->v & m->m) | (mark & ~m->m);
1973 }
1974
xfrm_if_id_put(struct sk_buff * skb,__u32 if_id)1975 static inline int xfrm_if_id_put(struct sk_buff *skb, __u32 if_id)
1976 {
1977 int ret = 0;
1978
1979 if (if_id)
1980 ret = nla_put_u32(skb, XFRMA_IF_ID, if_id);
1981 return ret;
1982 }
1983
xfrm_tunnel_check(struct sk_buff * skb,struct xfrm_state * x,unsigned int family)1984 static inline int xfrm_tunnel_check(struct sk_buff *skb, struct xfrm_state *x,
1985 unsigned int family)
1986 {
1987 bool tunnel = false;
1988
1989 switch(family) {
1990 case AF_INET:
1991 if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4)
1992 tunnel = true;
1993 break;
1994 case AF_INET6:
1995 if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6)
1996 tunnel = true;
1997 break;
1998 }
1999 if (tunnel && !(x->outer_mode.flags & XFRM_MODE_FLAG_TUNNEL))
2000 return -EINVAL;
2001
2002 return 0;
2003 }
2004
2005 extern const int xfrm_msg_min[XFRM_NR_MSGTYPES];
2006 extern const struct nla_policy xfrma_policy[XFRMA_MAX+1];
2007
2008 struct xfrm_translator {
2009 /* Allocate frag_list and put compat translation there */
2010 int (*alloc_compat)(struct sk_buff *skb, const struct nlmsghdr *src);
2011
2012 /* Allocate nlmsg with 64-bit translaton of received 32-bit message */
2013 struct nlmsghdr *(*rcv_msg_compat)(const struct nlmsghdr *nlh,
2014 int maxtype, const struct nla_policy *policy,
2015 struct netlink_ext_ack *extack);
2016
2017 /* Translate 32-bit user_policy from sockptr */
2018 int (*xlate_user_policy_sockptr)(u8 **pdata32, int optlen);
2019
2020 struct module *owner;
2021 };
2022
2023 #if IS_ENABLED(CONFIG_XFRM_USER_COMPAT)
2024 extern int xfrm_register_translator(struct xfrm_translator *xtr);
2025 extern int xfrm_unregister_translator(struct xfrm_translator *xtr);
2026 extern struct xfrm_translator *xfrm_get_translator(void);
2027 extern void xfrm_put_translator(struct xfrm_translator *xtr);
2028 #else
xfrm_get_translator(void)2029 static inline struct xfrm_translator *xfrm_get_translator(void)
2030 {
2031 return NULL;
2032 }
xfrm_put_translator(struct xfrm_translator * xtr)2033 static inline void xfrm_put_translator(struct xfrm_translator *xtr)
2034 {
2035 }
2036 #endif
2037
2038 #if IS_ENABLED(CONFIG_IPV6)
xfrm6_local_dontfrag(const struct sock * sk)2039 static inline bool xfrm6_local_dontfrag(const struct sock *sk)
2040 {
2041 int proto;
2042
2043 if (!sk || sk->sk_family != AF_INET6)
2044 return false;
2045
2046 proto = sk->sk_protocol;
2047 if (proto == IPPROTO_UDP || proto == IPPROTO_RAW)
2048 return inet6_sk(sk)->dontfrag;
2049
2050 return false;
2051 }
2052 #endif
2053 #endif /* _NET_XFRM_H */
2054