1 /* SPDX-License-Identifier: GPL-2.0 */
2 #ifndef _NET_XFRM_H
3 #define _NET_XFRM_H
4
5 #include <linux/compiler.h>
6 #include <linux/xfrm.h>
7 #include <linux/spinlock.h>
8 #include <linux/list.h>
9 #include <linux/skbuff.h>
10 #include <linux/socket.h>
11 #include <linux/pfkeyv2.h>
12 #include <linux/ipsec.h>
13 #include <linux/in6.h>
14 #include <linux/mutex.h>
15 #include <linux/audit.h>
16 #include <linux/slab.h>
17 #include <linux/refcount.h>
18 #include <linux/sockptr.h>
19
20 #include <net/sock.h>
21 #include <net/dst.h>
22 #include <net/ip.h>
23 #include <net/route.h>
24 #include <net/ipv6.h>
25 #include <net/ip6_fib.h>
26 #include <net/flow.h>
27 #include <net/gro_cells.h>
28
29 #include <linux/interrupt.h>
30
31 #ifdef CONFIG_XFRM_STATISTICS
32 #include <net/snmp.h>
33 #endif
34
35 #define XFRM_PROTO_ESP 50
36 #define XFRM_PROTO_AH 51
37 #define XFRM_PROTO_COMP 108
38 #define XFRM_PROTO_IPIP 4
39 #define XFRM_PROTO_IPV6 41
40 #define XFRM_PROTO_ROUTING IPPROTO_ROUTING
41 #define XFRM_PROTO_DSTOPTS IPPROTO_DSTOPTS
42
43 #define XFRM_ALIGN4(len) (((len) + 3) & ~3)
44 #define XFRM_ALIGN8(len) (((len) + 7) & ~7)
45 #define MODULE_ALIAS_XFRM_MODE(family, encap) \
46 MODULE_ALIAS("xfrm-mode-" __stringify(family) "-" __stringify(encap))
47 #define MODULE_ALIAS_XFRM_TYPE(family, proto) \
48 MODULE_ALIAS("xfrm-type-" __stringify(family) "-" __stringify(proto))
49 #define MODULE_ALIAS_XFRM_OFFLOAD_TYPE(family, proto) \
50 MODULE_ALIAS("xfrm-offload-" __stringify(family) "-" __stringify(proto))
51
52 #ifdef CONFIG_XFRM_STATISTICS
53 #define XFRM_INC_STATS(net, field) SNMP_INC_STATS((net)->mib.xfrm_statistics, field)
54 #else
55 #define XFRM_INC_STATS(net, field) ((void)(net))
56 #endif
57
58
59 /* Organization of SPD aka "XFRM rules"
60 ------------------------------------
61
62 Basic objects:
63 - policy rule, struct xfrm_policy (=SPD entry)
64 - bundle of transformations, struct dst_entry == struct xfrm_dst (=SA bundle)
65 - instance of a transformer, struct xfrm_state (=SA)
66 - template to clone xfrm_state, struct xfrm_tmpl
67
68 SPD is plain linear list of xfrm_policy rules, ordered by priority.
69 (To be compatible with existing pfkeyv2 implementations,
70 many rules with priority of 0x7fffffff are allowed to exist and
71 such rules are ordered in an unpredictable way, thanks to bsd folks.)
72
73 Lookup is plain linear search until the first match with selector.
74
75 If "action" is "block", then we prohibit the flow, otherwise:
76 if "xfrms_nr" is zero, the flow passes untransformed. Otherwise,
77 policy entry has list of up to XFRM_MAX_DEPTH transformations,
78 described by templates xfrm_tmpl. Each template is resolved
79 to a complete xfrm_state (see below) and we pack bundle of transformations
80 to a dst_entry returned to requestor.
81
82 dst -. xfrm .-> xfrm_state #1
83 |---. child .-> dst -. xfrm .-> xfrm_state #2
84 |---. child .-> dst -. xfrm .-> xfrm_state #3
85 |---. child .-> NULL
86
87 Bundles are cached at xrfm_policy struct (field ->bundles).
88
89
90 Resolution of xrfm_tmpl
91 -----------------------
92 Template contains:
93 1. ->mode Mode: transport or tunnel
94 2. ->id.proto Protocol: AH/ESP/IPCOMP
95 3. ->id.daddr Remote tunnel endpoint, ignored for transport mode.
96 Q: allow to resolve security gateway?
97 4. ->id.spi If not zero, static SPI.
98 5. ->saddr Local tunnel endpoint, ignored for transport mode.
99 6. ->algos List of allowed algos. Plain bitmask now.
100 Q: ealgos, aalgos, calgos. What a mess...
101 7. ->share Sharing mode.
102 Q: how to implement private sharing mode? To add struct sock* to
103 flow id?
104
105 Having this template we search through SAD searching for entries
106 with appropriate mode/proto/algo, permitted by selector.
107 If no appropriate entry found, it is requested from key manager.
108
109 PROBLEMS:
110 Q: How to find all the bundles referring to a physical path for
111 PMTU discovery? Seems, dst should contain list of all parents...
112 and enter to infinite locking hierarchy disaster.
113 No! It is easier, we will not search for them, let them find us.
114 We add genid to each dst plus pointer to genid of raw IP route,
115 pmtu disc will update pmtu on raw IP route and increase its genid.
116 dst_check() will see this for top level and trigger resyncing
117 metrics. Plus, it will be made via sk->sk_dst_cache. Solved.
118 */
119
120 struct xfrm_state_walk {
121 struct list_head all;
122 u8 state;
123 u8 dying;
124 u8 proto;
125 u32 seq;
126 struct xfrm_address_filter *filter;
127 };
128
129 struct xfrm_state_offload {
130 struct net_device *dev;
131 struct net_device *real_dev;
132 unsigned long offload_handle;
133 unsigned int num_exthdrs;
134 u8 flags;
135 };
136
137 struct xfrm_mode {
138 u8 encap;
139 u8 family;
140 u8 flags;
141 };
142
143 /* Flags for xfrm_mode. */
144 enum {
145 XFRM_MODE_FLAG_TUNNEL = 1,
146 };
147
148 /* Full description of state of transformer. */
149 struct xfrm_state {
150 possible_net_t xs_net;
151 union {
152 struct hlist_node gclist;
153 struct hlist_node bydst;
154 };
155 struct hlist_node bysrc;
156 struct hlist_node byspi;
157
158 refcount_t refcnt;
159 spinlock_t lock;
160
161 struct xfrm_id id;
162 struct xfrm_selector sel;
163 struct xfrm_mark mark;
164 u32 if_id;
165 u32 tfcpad;
166
167 u32 genid;
168
169 /* Key manager bits */
170 struct xfrm_state_walk km;
171
172 /* Parameters of this state. */
173 struct {
174 u32 reqid;
175 u8 mode;
176 u8 replay_window;
177 u8 aalgo, ealgo, calgo;
178 u8 flags;
179 u16 family;
180 xfrm_address_t saddr;
181 int header_len;
182 int trailer_len;
183 u32 extra_flags;
184 struct xfrm_mark smark;
185 } props;
186
187 struct xfrm_lifetime_cfg lft;
188
189 /* Data for transformer */
190 struct xfrm_algo_auth *aalg;
191 struct xfrm_algo *ealg;
192 struct xfrm_algo *calg;
193 struct xfrm_algo_aead *aead;
194 const char *geniv;
195
196 /* mapping change rate limiting */
197 __be16 new_mapping_sport;
198 u32 new_mapping; /* seconds */
199 u32 mapping_maxage; /* seconds for input SA */
200
201 /* Data for encapsulator */
202 struct xfrm_encap_tmpl *encap;
203 struct sock __rcu *encap_sk;
204
205 /* Data for care-of address */
206 xfrm_address_t *coaddr;
207
208 /* IPComp needs an IPIP tunnel for handling uncompressed packets */
209 struct xfrm_state *tunnel;
210
211 /* If a tunnel, number of users + 1 */
212 atomic_t tunnel_users;
213
214 /* State for replay detection */
215 struct xfrm_replay_state replay;
216 struct xfrm_replay_state_esn *replay_esn;
217
218 /* Replay detection state at the time we sent the last notification */
219 struct xfrm_replay_state preplay;
220 struct xfrm_replay_state_esn *preplay_esn;
221
222 /* The functions for replay detection. */
223 const struct xfrm_replay *repl;
224
225 /* internal flag that only holds state for delayed aevent at the
226 * moment
227 */
228 u32 xflags;
229
230 /* Replay detection notification settings */
231 u32 replay_maxage;
232 u32 replay_maxdiff;
233
234 /* Replay detection notification timer */
235 struct timer_list rtimer;
236
237 /* Statistics */
238 struct xfrm_stats stats;
239
240 struct xfrm_lifetime_cur curlft;
241 struct hrtimer mtimer;
242
243 struct xfrm_state_offload xso;
244
245 /* used to fix curlft->add_time when changing date */
246 long saved_tmo;
247
248 /* Last used time */
249 time64_t lastused;
250
251 struct page_frag xfrag;
252
253 /* Reference to data common to all the instances of this
254 * transformer. */
255 const struct xfrm_type *type;
256 struct xfrm_mode inner_mode;
257 struct xfrm_mode inner_mode_iaf;
258 struct xfrm_mode outer_mode;
259
260 const struct xfrm_type_offload *type_offload;
261
262 /* Security context */
263 struct xfrm_sec_ctx *security;
264
265 /* Private data of this transformer, format is opaque,
266 * interpreted by xfrm_type methods. */
267 void *data;
268 };
269
xs_net(struct xfrm_state * x)270 static inline struct net *xs_net(struct xfrm_state *x)
271 {
272 return read_pnet(&x->xs_net);
273 }
274
275 /* xflags - make enum if more show up */
276 #define XFRM_TIME_DEFER 1
277 #define XFRM_SOFT_EXPIRE 2
278
279 enum {
280 XFRM_STATE_VOID,
281 XFRM_STATE_ACQ,
282 XFRM_STATE_VALID,
283 XFRM_STATE_ERROR,
284 XFRM_STATE_EXPIRED,
285 XFRM_STATE_DEAD
286 };
287
288 /* callback structure passed from either netlink or pfkey */
289 struct km_event {
290 union {
291 u32 hard;
292 u32 proto;
293 u32 byid;
294 u32 aevent;
295 u32 type;
296 } data;
297
298 u32 seq;
299 u32 portid;
300 u32 event;
301 struct net *net;
302 };
303
304 struct xfrm_replay {
305 void (*advance)(struct xfrm_state *x, __be32 net_seq);
306 int (*check)(struct xfrm_state *x,
307 struct sk_buff *skb,
308 __be32 net_seq);
309 int (*recheck)(struct xfrm_state *x,
310 struct sk_buff *skb,
311 __be32 net_seq);
312 void (*notify)(struct xfrm_state *x, int event);
313 int (*overflow)(struct xfrm_state *x, struct sk_buff *skb);
314 };
315
316 struct xfrm_if_cb {
317 struct xfrm_if *(*decode_session)(struct sk_buff *skb,
318 unsigned short family);
319 };
320
321 void xfrm_if_register_cb(const struct xfrm_if_cb *ifcb);
322 void xfrm_if_unregister_cb(void);
323
324 struct net_device;
325 struct xfrm_type;
326 struct xfrm_dst;
327 struct xfrm_policy_afinfo {
328 struct dst_ops *dst_ops;
329 struct dst_entry *(*dst_lookup)(struct net *net,
330 int tos, int oif,
331 const xfrm_address_t *saddr,
332 const xfrm_address_t *daddr,
333 u32 mark);
334 int (*get_saddr)(struct net *net, int oif,
335 xfrm_address_t *saddr,
336 xfrm_address_t *daddr,
337 u32 mark);
338 int (*fill_dst)(struct xfrm_dst *xdst,
339 struct net_device *dev,
340 const struct flowi *fl);
341 struct dst_entry *(*blackhole_route)(struct net *net, struct dst_entry *orig);
342 };
343
344 int xfrm_policy_register_afinfo(const struct xfrm_policy_afinfo *afinfo, int family);
345 void xfrm_policy_unregister_afinfo(const struct xfrm_policy_afinfo *afinfo);
346 void km_policy_notify(struct xfrm_policy *xp, int dir,
347 const struct km_event *c);
348 void km_state_notify(struct xfrm_state *x, const struct km_event *c);
349
350 struct xfrm_tmpl;
351 int km_query(struct xfrm_state *x, struct xfrm_tmpl *t,
352 struct xfrm_policy *pol);
353 void km_state_expired(struct xfrm_state *x, int hard, u32 portid);
354 int __xfrm_state_delete(struct xfrm_state *x);
355
356 struct xfrm_state_afinfo {
357 u8 family;
358 u8 proto;
359
360 const struct xfrm_type_offload *type_offload_esp;
361
362 const struct xfrm_type *type_esp;
363 const struct xfrm_type *type_ipip;
364 const struct xfrm_type *type_ipip6;
365 const struct xfrm_type *type_comp;
366 const struct xfrm_type *type_ah;
367 const struct xfrm_type *type_routing;
368 const struct xfrm_type *type_dstopts;
369
370 int (*output)(struct net *net, struct sock *sk, struct sk_buff *skb);
371 int (*transport_finish)(struct sk_buff *skb,
372 int async);
373 void (*local_error)(struct sk_buff *skb, u32 mtu);
374 };
375
376 int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo);
377 int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo);
378 struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family);
379 struct xfrm_state_afinfo *xfrm_state_afinfo_get_rcu(unsigned int family);
380
381 struct xfrm_input_afinfo {
382 u8 family;
383 bool is_ipip;
384 int (*callback)(struct sk_buff *skb, u8 protocol,
385 int err);
386 };
387
388 int xfrm_input_register_afinfo(const struct xfrm_input_afinfo *afinfo);
389 int xfrm_input_unregister_afinfo(const struct xfrm_input_afinfo *afinfo);
390
391 void xfrm_flush_gc(void);
392 void xfrm_state_delete_tunnel(struct xfrm_state *x);
393
394 struct xfrm_type {
395 char *description;
396 struct module *owner;
397 u8 proto;
398 u8 flags;
399 #define XFRM_TYPE_NON_FRAGMENT 1
400 #define XFRM_TYPE_REPLAY_PROT 2
401 #define XFRM_TYPE_LOCAL_COADDR 4
402 #define XFRM_TYPE_REMOTE_COADDR 8
403
404 int (*init_state)(struct xfrm_state *x);
405 void (*destructor)(struct xfrm_state *);
406 int (*input)(struct xfrm_state *, struct sk_buff *skb);
407 int (*output)(struct xfrm_state *, struct sk_buff *pskb);
408 int (*reject)(struct xfrm_state *, struct sk_buff *,
409 const struct flowi *);
410 int (*hdr_offset)(struct xfrm_state *, struct sk_buff *, u8 **);
411 };
412
413 int xfrm_register_type(const struct xfrm_type *type, unsigned short family);
414 void xfrm_unregister_type(const struct xfrm_type *type, unsigned short family);
415
416 struct xfrm_type_offload {
417 char *description;
418 struct module *owner;
419 u8 proto;
420 void (*encap)(struct xfrm_state *, struct sk_buff *pskb);
421 int (*input_tail)(struct xfrm_state *x, struct sk_buff *skb);
422 int (*xmit)(struct xfrm_state *, struct sk_buff *pskb, netdev_features_t features);
423 };
424
425 int xfrm_register_type_offload(const struct xfrm_type_offload *type, unsigned short family);
426 void xfrm_unregister_type_offload(const struct xfrm_type_offload *type, unsigned short family);
427
xfrm_af2proto(unsigned int family)428 static inline int xfrm_af2proto(unsigned int family)
429 {
430 switch(family) {
431 case AF_INET:
432 return IPPROTO_IPIP;
433 case AF_INET6:
434 return IPPROTO_IPV6;
435 default:
436 return 0;
437 }
438 }
439
xfrm_ip2inner_mode(struct xfrm_state * x,int ipproto)440 static inline const struct xfrm_mode *xfrm_ip2inner_mode(struct xfrm_state *x, int ipproto)
441 {
442 if ((ipproto == IPPROTO_IPIP && x->props.family == AF_INET) ||
443 (ipproto == IPPROTO_IPV6 && x->props.family == AF_INET6))
444 return &x->inner_mode;
445 else
446 return &x->inner_mode_iaf;
447 }
448
449 struct xfrm_tmpl {
450 /* id in template is interpreted as:
451 * daddr - destination of tunnel, may be zero for transport mode.
452 * spi - zero to acquire spi. Not zero if spi is static, then
453 * daddr must be fixed too.
454 * proto - AH/ESP/IPCOMP
455 */
456 struct xfrm_id id;
457
458 /* Source address of tunnel. Ignored, if it is not a tunnel. */
459 xfrm_address_t saddr;
460
461 unsigned short encap_family;
462
463 u32 reqid;
464
465 /* Mode: transport, tunnel etc. */
466 u8 mode;
467
468 /* Sharing mode: unique, this session only, this user only etc. */
469 u8 share;
470
471 /* May skip this transfomration if no SA is found */
472 u8 optional;
473
474 /* Skip aalgos/ealgos/calgos checks. */
475 u8 allalgs;
476
477 /* Bit mask of algos allowed for acquisition */
478 u32 aalgos;
479 u32 ealgos;
480 u32 calgos;
481 };
482
483 #define XFRM_MAX_DEPTH 6
484 #define XFRM_MAX_OFFLOAD_DEPTH 1
485
486 struct xfrm_policy_walk_entry {
487 struct list_head all;
488 u8 dead;
489 };
490
491 struct xfrm_policy_walk {
492 struct xfrm_policy_walk_entry walk;
493 u8 type;
494 u32 seq;
495 };
496
497 struct xfrm_policy_queue {
498 struct sk_buff_head hold_queue;
499 struct timer_list hold_timer;
500 unsigned long timeout;
501 };
502
503 struct xfrm_policy {
504 possible_net_t xp_net;
505 struct hlist_node bydst;
506 struct hlist_node byidx;
507
508 /* This lock only affects elements except for entry. */
509 rwlock_t lock;
510 refcount_t refcnt;
511 u32 pos;
512 struct timer_list timer;
513
514 atomic_t genid;
515 u32 priority;
516 u32 index;
517 u32 if_id;
518 struct xfrm_mark mark;
519 struct xfrm_selector selector;
520 struct xfrm_lifetime_cfg lft;
521 struct xfrm_lifetime_cur curlft;
522 struct xfrm_policy_walk_entry walk;
523 struct xfrm_policy_queue polq;
524 bool bydst_reinsert;
525 u8 type;
526 u8 action;
527 u8 flags;
528 u8 xfrm_nr;
529 u16 family;
530 struct xfrm_sec_ctx *security;
531 struct xfrm_tmpl xfrm_vec[XFRM_MAX_DEPTH];
532 struct hlist_node bydst_inexact_list;
533 struct rcu_head rcu;
534 };
535
xp_net(const struct xfrm_policy * xp)536 static inline struct net *xp_net(const struct xfrm_policy *xp)
537 {
538 return read_pnet(&xp->xp_net);
539 }
540
541 struct xfrm_kmaddress {
542 xfrm_address_t local;
543 xfrm_address_t remote;
544 u32 reserved;
545 u16 family;
546 };
547
548 struct xfrm_migrate {
549 xfrm_address_t old_daddr;
550 xfrm_address_t old_saddr;
551 xfrm_address_t new_daddr;
552 xfrm_address_t new_saddr;
553 u8 proto;
554 u8 mode;
555 u16 reserved;
556 u32 reqid;
557 u16 old_family;
558 u16 new_family;
559 };
560
561 #define XFRM_KM_TIMEOUT 30
562 /* what happened */
563 #define XFRM_REPLAY_UPDATE XFRM_AE_CR
564 #define XFRM_REPLAY_TIMEOUT XFRM_AE_CE
565
566 /* default aevent timeout in units of 100ms */
567 #define XFRM_AE_ETIME 10
568 /* Async Event timer multiplier */
569 #define XFRM_AE_ETH_M 10
570 /* default seq threshold size */
571 #define XFRM_AE_SEQT_SIZE 2
572
573 struct xfrm_mgr {
574 struct list_head list;
575 int (*notify)(struct xfrm_state *x, const struct km_event *c);
576 int (*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp);
577 struct xfrm_policy *(*compile_policy)(struct sock *sk, int opt, u8 *data, int len, int *dir);
578 int (*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
579 int (*notify_policy)(struct xfrm_policy *x, int dir, const struct km_event *c);
580 int (*report)(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr);
581 int (*migrate)(const struct xfrm_selector *sel,
582 u8 dir, u8 type,
583 const struct xfrm_migrate *m,
584 int num_bundles,
585 const struct xfrm_kmaddress *k,
586 const struct xfrm_encap_tmpl *encap);
587 bool (*is_alive)(const struct km_event *c);
588 };
589
590 int xfrm_register_km(struct xfrm_mgr *km);
591 int xfrm_unregister_km(struct xfrm_mgr *km);
592
593 struct xfrm_tunnel_skb_cb {
594 union {
595 struct inet_skb_parm h4;
596 struct inet6_skb_parm h6;
597 } header;
598
599 union {
600 struct ip_tunnel *ip4;
601 struct ip6_tnl *ip6;
602 } tunnel;
603 };
604
605 #define XFRM_TUNNEL_SKB_CB(__skb) ((struct xfrm_tunnel_skb_cb *)&((__skb)->cb[0]))
606
607 /*
608 * This structure is used for the duration where packets are being
609 * transformed by IPsec. As soon as the packet leaves IPsec the
610 * area beyond the generic IP part may be overwritten.
611 */
612 struct xfrm_skb_cb {
613 struct xfrm_tunnel_skb_cb header;
614
615 /* Sequence number for replay protection. */
616 union {
617 struct {
618 __u32 low;
619 __u32 hi;
620 } output;
621 struct {
622 __be32 low;
623 __be32 hi;
624 } input;
625 } seq;
626 };
627
628 #define XFRM_SKB_CB(__skb) ((struct xfrm_skb_cb *)&((__skb)->cb[0]))
629
630 /*
631 * This structure is used by the afinfo prepare_input/prepare_output functions
632 * to transmit header information to the mode input/output functions.
633 */
634 struct xfrm_mode_skb_cb {
635 struct xfrm_tunnel_skb_cb header;
636
637 /* Copied from header for IPv4, always set to zero and DF for IPv6. */
638 __be16 id;
639 __be16 frag_off;
640
641 /* IP header length (excluding options or extension headers). */
642 u8 ihl;
643
644 /* TOS for IPv4, class for IPv6. */
645 u8 tos;
646
647 /* TTL for IPv4, hop limitfor IPv6. */
648 u8 ttl;
649
650 /* Protocol for IPv4, NH for IPv6. */
651 u8 protocol;
652
653 /* Option length for IPv4, zero for IPv6. */
654 u8 optlen;
655
656 /* Used by IPv6 only, zero for IPv4. */
657 u8 flow_lbl[3];
658 };
659
660 #define XFRM_MODE_SKB_CB(__skb) ((struct xfrm_mode_skb_cb *)&((__skb)->cb[0]))
661
662 /*
663 * This structure is used by the input processing to locate the SPI and
664 * related information.
665 */
666 struct xfrm_spi_skb_cb {
667 struct xfrm_tunnel_skb_cb header;
668
669 unsigned int daddroff;
670 unsigned int family;
671 __be32 seq;
672 };
673
674 #define XFRM_SPI_SKB_CB(__skb) ((struct xfrm_spi_skb_cb *)&((__skb)->cb[0]))
675
676 #ifdef CONFIG_AUDITSYSCALL
xfrm_audit_start(const char * op)677 static inline struct audit_buffer *xfrm_audit_start(const char *op)
678 {
679 struct audit_buffer *audit_buf = NULL;
680
681 if (audit_enabled == AUDIT_OFF)
682 return NULL;
683 audit_buf = audit_log_start(audit_context(), GFP_ATOMIC,
684 AUDIT_MAC_IPSEC_EVENT);
685 if (audit_buf == NULL)
686 return NULL;
687 audit_log_format(audit_buf, "op=%s", op);
688 return audit_buf;
689 }
690
xfrm_audit_helper_usrinfo(bool task_valid,struct audit_buffer * audit_buf)691 static inline void xfrm_audit_helper_usrinfo(bool task_valid,
692 struct audit_buffer *audit_buf)
693 {
694 const unsigned int auid = from_kuid(&init_user_ns, task_valid ?
695 audit_get_loginuid(current) :
696 INVALID_UID);
697 const unsigned int ses = task_valid ? audit_get_sessionid(current) :
698 AUDIT_SID_UNSET;
699
700 audit_log_format(audit_buf, " auid=%u ses=%u", auid, ses);
701 audit_log_task_context(audit_buf);
702 }
703
704 void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, bool task_valid);
705 void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
706 bool task_valid);
707 void xfrm_audit_state_add(struct xfrm_state *x, int result, bool task_valid);
708 void xfrm_audit_state_delete(struct xfrm_state *x, int result, bool task_valid);
709 void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
710 struct sk_buff *skb);
711 void xfrm_audit_state_replay(struct xfrm_state *x, struct sk_buff *skb,
712 __be32 net_seq);
713 void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family);
714 void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, __be32 net_spi,
715 __be32 net_seq);
716 void xfrm_audit_state_icvfail(struct xfrm_state *x, struct sk_buff *skb,
717 u8 proto);
718 #else
719
xfrm_audit_policy_add(struct xfrm_policy * xp,int result,bool task_valid)720 static inline void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
721 bool task_valid)
722 {
723 }
724
xfrm_audit_policy_delete(struct xfrm_policy * xp,int result,bool task_valid)725 static inline void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
726 bool task_valid)
727 {
728 }
729
xfrm_audit_state_add(struct xfrm_state * x,int result,bool task_valid)730 static inline void xfrm_audit_state_add(struct xfrm_state *x, int result,
731 bool task_valid)
732 {
733 }
734
xfrm_audit_state_delete(struct xfrm_state * x,int result,bool task_valid)735 static inline void xfrm_audit_state_delete(struct xfrm_state *x, int result,
736 bool task_valid)
737 {
738 }
739
xfrm_audit_state_replay_overflow(struct xfrm_state * x,struct sk_buff * skb)740 static inline void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
741 struct sk_buff *skb)
742 {
743 }
744
xfrm_audit_state_replay(struct xfrm_state * x,struct sk_buff * skb,__be32 net_seq)745 static inline void xfrm_audit_state_replay(struct xfrm_state *x,
746 struct sk_buff *skb, __be32 net_seq)
747 {
748 }
749
xfrm_audit_state_notfound_simple(struct sk_buff * skb,u16 family)750 static inline void xfrm_audit_state_notfound_simple(struct sk_buff *skb,
751 u16 family)
752 {
753 }
754
xfrm_audit_state_notfound(struct sk_buff * skb,u16 family,__be32 net_spi,__be32 net_seq)755 static inline void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
756 __be32 net_spi, __be32 net_seq)
757 {
758 }
759
xfrm_audit_state_icvfail(struct xfrm_state * x,struct sk_buff * skb,u8 proto)760 static inline void xfrm_audit_state_icvfail(struct xfrm_state *x,
761 struct sk_buff *skb, u8 proto)
762 {
763 }
764 #endif /* CONFIG_AUDITSYSCALL */
765
xfrm_pol_hold(struct xfrm_policy * policy)766 static inline void xfrm_pol_hold(struct xfrm_policy *policy)
767 {
768 if (likely(policy != NULL))
769 refcount_inc(&policy->refcnt);
770 }
771
772 void xfrm_policy_destroy(struct xfrm_policy *policy);
773
xfrm_pol_put(struct xfrm_policy * policy)774 static inline void xfrm_pol_put(struct xfrm_policy *policy)
775 {
776 if (refcount_dec_and_test(&policy->refcnt))
777 xfrm_policy_destroy(policy);
778 }
779
xfrm_pols_put(struct xfrm_policy ** pols,int npols)780 static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols)
781 {
782 int i;
783 for (i = npols - 1; i >= 0; --i)
784 xfrm_pol_put(pols[i]);
785 }
786
787 void __xfrm_state_destroy(struct xfrm_state *, bool);
788
__xfrm_state_put(struct xfrm_state * x)789 static inline void __xfrm_state_put(struct xfrm_state *x)
790 {
791 refcount_dec(&x->refcnt);
792 }
793
xfrm_state_put(struct xfrm_state * x)794 static inline void xfrm_state_put(struct xfrm_state *x)
795 {
796 if (refcount_dec_and_test(&x->refcnt))
797 __xfrm_state_destroy(x, false);
798 }
799
xfrm_state_put_sync(struct xfrm_state * x)800 static inline void xfrm_state_put_sync(struct xfrm_state *x)
801 {
802 if (refcount_dec_and_test(&x->refcnt))
803 __xfrm_state_destroy(x, true);
804 }
805
xfrm_state_hold(struct xfrm_state * x)806 static inline void xfrm_state_hold(struct xfrm_state *x)
807 {
808 refcount_inc(&x->refcnt);
809 }
810
addr_match(const void * token1,const void * token2,unsigned int prefixlen)811 static inline bool addr_match(const void *token1, const void *token2,
812 unsigned int prefixlen)
813 {
814 const __be32 *a1 = token1;
815 const __be32 *a2 = token2;
816 unsigned int pdw;
817 unsigned int pbi;
818
819 pdw = prefixlen >> 5; /* num of whole u32 in prefix */
820 pbi = prefixlen & 0x1f; /* num of bits in incomplete u32 in prefix */
821
822 if (pdw)
823 if (memcmp(a1, a2, pdw << 2))
824 return false;
825
826 if (pbi) {
827 __be32 mask;
828
829 mask = htonl((0xffffffff) << (32 - pbi));
830
831 if ((a1[pdw] ^ a2[pdw]) & mask)
832 return false;
833 }
834
835 return true;
836 }
837
addr4_match(__be32 a1,__be32 a2,u8 prefixlen)838 static inline bool addr4_match(__be32 a1, __be32 a2, u8 prefixlen)
839 {
840 /* C99 6.5.7 (3): u32 << 32 is undefined behaviour */
841 if (sizeof(long) == 4 && prefixlen == 0)
842 return true;
843 return !((a1 ^ a2) & htonl(~0UL << (32 - prefixlen)));
844 }
845
846 static __inline__
xfrm_flowi_sport(const struct flowi * fl,const union flowi_uli * uli)847 __be16 xfrm_flowi_sport(const struct flowi *fl, const union flowi_uli *uli)
848 {
849 __be16 port;
850 switch(fl->flowi_proto) {
851 case IPPROTO_TCP:
852 case IPPROTO_UDP:
853 case IPPROTO_UDPLITE:
854 case IPPROTO_SCTP:
855 port = uli->ports.sport;
856 break;
857 case IPPROTO_ICMP:
858 case IPPROTO_ICMPV6:
859 port = htons(uli->icmpt.type);
860 break;
861 case IPPROTO_MH:
862 port = htons(uli->mht.type);
863 break;
864 case IPPROTO_GRE:
865 port = htons(ntohl(uli->gre_key) >> 16);
866 break;
867 default:
868 port = 0; /*XXX*/
869 }
870 return port;
871 }
872
873 static __inline__
xfrm_flowi_dport(const struct flowi * fl,const union flowi_uli * uli)874 __be16 xfrm_flowi_dport(const struct flowi *fl, const union flowi_uli *uli)
875 {
876 __be16 port;
877 switch(fl->flowi_proto) {
878 case IPPROTO_TCP:
879 case IPPROTO_UDP:
880 case IPPROTO_UDPLITE:
881 case IPPROTO_SCTP:
882 port = uli->ports.dport;
883 break;
884 case IPPROTO_ICMP:
885 case IPPROTO_ICMPV6:
886 port = htons(uli->icmpt.code);
887 break;
888 case IPPROTO_GRE:
889 port = htons(ntohl(uli->gre_key) & 0xffff);
890 break;
891 default:
892 port = 0; /*XXX*/
893 }
894 return port;
895 }
896
897 bool xfrm_selector_match(const struct xfrm_selector *sel,
898 const struct flowi *fl, unsigned short family);
899
900 #ifdef CONFIG_SECURITY_NETWORK_XFRM
901 /* If neither has a context --> match
902 * Otherwise, both must have a context and the sids, doi, alg must match
903 */
xfrm_sec_ctx_match(struct xfrm_sec_ctx * s1,struct xfrm_sec_ctx * s2)904 static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
905 {
906 return ((!s1 && !s2) ||
907 (s1 && s2 &&
908 (s1->ctx_sid == s2->ctx_sid) &&
909 (s1->ctx_doi == s2->ctx_doi) &&
910 (s1->ctx_alg == s2->ctx_alg)));
911 }
912 #else
xfrm_sec_ctx_match(struct xfrm_sec_ctx * s1,struct xfrm_sec_ctx * s2)913 static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
914 {
915 return true;
916 }
917 #endif
918
919 /* A struct encoding bundle of transformations to apply to some set of flow.
920 *
921 * xdst->child points to the next element of bundle.
922 * dst->xfrm points to an instanse of transformer.
923 *
924 * Due to unfortunate limitations of current routing cache, which we
925 * have no time to fix, it mirrors struct rtable and bound to the same
926 * routing key, including saddr,daddr. However, we can have many of
927 * bundles differing by session id. All the bundles grow from a parent
928 * policy rule.
929 */
930 struct xfrm_dst {
931 union {
932 struct dst_entry dst;
933 struct rtable rt;
934 struct rt6_info rt6;
935 } u;
936 struct dst_entry *route;
937 struct dst_entry *child;
938 struct dst_entry *path;
939 struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX];
940 int num_pols, num_xfrms;
941 u32 xfrm_genid;
942 u32 policy_genid;
943 u32 route_mtu_cached;
944 u32 child_mtu_cached;
945 u32 route_cookie;
946 u32 path_cookie;
947 };
948
xfrm_dst_path(const struct dst_entry * dst)949 static inline struct dst_entry *xfrm_dst_path(const struct dst_entry *dst)
950 {
951 #ifdef CONFIG_XFRM
952 if (dst->xfrm || (dst->flags & DST_XFRM_QUEUE)) {
953 const struct xfrm_dst *xdst = (const struct xfrm_dst *) dst;
954
955 return xdst->path;
956 }
957 #endif
958 return (struct dst_entry *) dst;
959 }
960
xfrm_dst_child(const struct dst_entry * dst)961 static inline struct dst_entry *xfrm_dst_child(const struct dst_entry *dst)
962 {
963 #ifdef CONFIG_XFRM
964 if (dst->xfrm || (dst->flags & DST_XFRM_QUEUE)) {
965 struct xfrm_dst *xdst = (struct xfrm_dst *) dst;
966 return xdst->child;
967 }
968 #endif
969 return NULL;
970 }
971
972 #ifdef CONFIG_XFRM
xfrm_dst_set_child(struct xfrm_dst * xdst,struct dst_entry * child)973 static inline void xfrm_dst_set_child(struct xfrm_dst *xdst, struct dst_entry *child)
974 {
975 xdst->child = child;
976 }
977
xfrm_dst_destroy(struct xfrm_dst * xdst)978 static inline void xfrm_dst_destroy(struct xfrm_dst *xdst)
979 {
980 xfrm_pols_put(xdst->pols, xdst->num_pols);
981 dst_release(xdst->route);
982 if (likely(xdst->u.dst.xfrm))
983 xfrm_state_put(xdst->u.dst.xfrm);
984 }
985 #endif
986
987 void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev);
988
989 struct xfrm_if_parms {
990 int link; /* ifindex of underlying L2 interface */
991 u32 if_id; /* interface identifyer */
992 };
993
994 struct xfrm_if {
995 struct xfrm_if __rcu *next; /* next interface in list */
996 struct net_device *dev; /* virtual device associated with interface */
997 struct net *net; /* netns for packet i/o */
998 struct xfrm_if_parms p; /* interface parms */
999
1000 struct gro_cells gro_cells;
1001 };
1002
1003 struct xfrm_offload {
1004 /* Output sequence number for replay protection on offloading. */
1005 struct {
1006 __u32 low;
1007 __u32 hi;
1008 } seq;
1009
1010 __u32 flags;
1011 #define SA_DELETE_REQ 1
1012 #define CRYPTO_DONE 2
1013 #define CRYPTO_NEXT_DONE 4
1014 #define CRYPTO_FALLBACK 8
1015 #define XFRM_GSO_SEGMENT 16
1016 #define XFRM_GRO 32
1017 #define XFRM_ESP_NO_TRAILER 64
1018 #define XFRM_DEV_RESUME 128
1019 #define XFRM_XMIT 256
1020
1021 __u32 status;
1022 #define CRYPTO_SUCCESS 1
1023 #define CRYPTO_GENERIC_ERROR 2
1024 #define CRYPTO_TRANSPORT_AH_AUTH_FAILED 4
1025 #define CRYPTO_TRANSPORT_ESP_AUTH_FAILED 8
1026 #define CRYPTO_TUNNEL_AH_AUTH_FAILED 16
1027 #define CRYPTO_TUNNEL_ESP_AUTH_FAILED 32
1028 #define CRYPTO_INVALID_PACKET_SYNTAX 64
1029 #define CRYPTO_INVALID_PROTOCOL 128
1030
1031 __u8 proto;
1032 };
1033
1034 struct sec_path {
1035 int len;
1036 int olen;
1037
1038 struct xfrm_state *xvec[XFRM_MAX_DEPTH];
1039 struct xfrm_offload ovec[XFRM_MAX_OFFLOAD_DEPTH];
1040 };
1041
1042 struct sec_path *secpath_set(struct sk_buff *skb);
1043
1044 static inline void
secpath_reset(struct sk_buff * skb)1045 secpath_reset(struct sk_buff *skb)
1046 {
1047 #ifdef CONFIG_XFRM
1048 skb_ext_del(skb, SKB_EXT_SEC_PATH);
1049 #endif
1050 }
1051
1052 static inline int
xfrm_addr_any(const xfrm_address_t * addr,unsigned short family)1053 xfrm_addr_any(const xfrm_address_t *addr, unsigned short family)
1054 {
1055 switch (family) {
1056 case AF_INET:
1057 return addr->a4 == 0;
1058 case AF_INET6:
1059 return ipv6_addr_any(&addr->in6);
1060 }
1061 return 0;
1062 }
1063
1064 static inline int
__xfrm4_state_addr_cmp(const struct xfrm_tmpl * tmpl,const struct xfrm_state * x)1065 __xfrm4_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x)
1066 {
1067 return (tmpl->saddr.a4 &&
1068 tmpl->saddr.a4 != x->props.saddr.a4);
1069 }
1070
1071 static inline int
__xfrm6_state_addr_cmp(const struct xfrm_tmpl * tmpl,const struct xfrm_state * x)1072 __xfrm6_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x)
1073 {
1074 return (!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) &&
1075 !ipv6_addr_equal((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr));
1076 }
1077
1078 static inline int
xfrm_state_addr_cmp(const struct xfrm_tmpl * tmpl,const struct xfrm_state * x,unsigned short family)1079 xfrm_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x, unsigned short family)
1080 {
1081 switch (family) {
1082 case AF_INET:
1083 return __xfrm4_state_addr_cmp(tmpl, x);
1084 case AF_INET6:
1085 return __xfrm6_state_addr_cmp(tmpl, x);
1086 }
1087 return !0;
1088 }
1089
1090 #ifdef CONFIG_XFRM
1091 int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb,
1092 unsigned short family);
1093
__xfrm_check_nopolicy(struct net * net,struct sk_buff * skb,int dir)1094 static inline bool __xfrm_check_nopolicy(struct net *net, struct sk_buff *skb,
1095 int dir)
1096 {
1097 if (!net->xfrm.policy_count[dir] && !secpath_exists(skb))
1098 return net->xfrm.policy_default[dir] == XFRM_USERPOLICY_ACCEPT;
1099
1100 return false;
1101 }
1102
__xfrm_check_dev_nopolicy(struct sk_buff * skb,int dir,unsigned short family)1103 static inline bool __xfrm_check_dev_nopolicy(struct sk_buff *skb,
1104 int dir, unsigned short family)
1105 {
1106 if (dir != XFRM_POLICY_OUT && family == AF_INET) {
1107 /* same dst may be used for traffic originating from
1108 * devices with different policy settings.
1109 */
1110 return IPCB(skb)->flags & IPSKB_NOPOLICY;
1111 }
1112 return skb_dst(skb) && (skb_dst(skb)->flags & DST_NOPOLICY);
1113 }
1114
__xfrm_policy_check2(struct sock * sk,int dir,struct sk_buff * skb,unsigned int family,int reverse)1115 static inline int __xfrm_policy_check2(struct sock *sk, int dir,
1116 struct sk_buff *skb,
1117 unsigned int family, int reverse)
1118 {
1119 struct net *net = dev_net(skb->dev);
1120 int ndir = dir | (reverse ? XFRM_POLICY_MASK + 1 : 0);
1121
1122 if (sk && sk->sk_policy[XFRM_POLICY_IN])
1123 return __xfrm_policy_check(sk, ndir, skb, family);
1124
1125 return __xfrm_check_nopolicy(net, skb, dir) ||
1126 __xfrm_check_dev_nopolicy(skb, dir, family) ||
1127 __xfrm_policy_check(sk, ndir, skb, family);
1128 }
1129
xfrm_policy_check(struct sock * sk,int dir,struct sk_buff * skb,unsigned short family)1130 static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
1131 {
1132 return __xfrm_policy_check2(sk, dir, skb, family, 0);
1133 }
1134
xfrm4_policy_check(struct sock * sk,int dir,struct sk_buff * skb)1135 static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1136 {
1137 return xfrm_policy_check(sk, dir, skb, AF_INET);
1138 }
1139
xfrm6_policy_check(struct sock * sk,int dir,struct sk_buff * skb)1140 static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1141 {
1142 return xfrm_policy_check(sk, dir, skb, AF_INET6);
1143 }
1144
xfrm4_policy_check_reverse(struct sock * sk,int dir,struct sk_buff * skb)1145 static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
1146 struct sk_buff *skb)
1147 {
1148 return __xfrm_policy_check2(sk, dir, skb, AF_INET, 1);
1149 }
1150
xfrm6_policy_check_reverse(struct sock * sk,int dir,struct sk_buff * skb)1151 static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
1152 struct sk_buff *skb)
1153 {
1154 return __xfrm_policy_check2(sk, dir, skb, AF_INET6, 1);
1155 }
1156
1157 int __xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
1158 unsigned int family, int reverse);
1159
xfrm_decode_session(struct sk_buff * skb,struct flowi * fl,unsigned int family)1160 static inline int xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
1161 unsigned int family)
1162 {
1163 return __xfrm_decode_session(skb, fl, family, 0);
1164 }
1165
xfrm_decode_session_reverse(struct sk_buff * skb,struct flowi * fl,unsigned int family)1166 static inline int xfrm_decode_session_reverse(struct sk_buff *skb,
1167 struct flowi *fl,
1168 unsigned int family)
1169 {
1170 return __xfrm_decode_session(skb, fl, family, 1);
1171 }
1172
1173 int __xfrm_route_forward(struct sk_buff *skb, unsigned short family);
1174
xfrm_route_forward(struct sk_buff * skb,unsigned short family)1175 static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family)
1176 {
1177 struct net *net = dev_net(skb->dev);
1178
1179 if (!net->xfrm.policy_count[XFRM_POLICY_OUT] &&
1180 net->xfrm.policy_default[XFRM_POLICY_OUT] == XFRM_USERPOLICY_ACCEPT)
1181 return true;
1182
1183 return (skb_dst(skb)->flags & DST_NOXFRM) ||
1184 __xfrm_route_forward(skb, family);
1185 }
1186
xfrm4_route_forward(struct sk_buff * skb)1187 static inline int xfrm4_route_forward(struct sk_buff *skb)
1188 {
1189 return xfrm_route_forward(skb, AF_INET);
1190 }
1191
xfrm6_route_forward(struct sk_buff * skb)1192 static inline int xfrm6_route_forward(struct sk_buff *skb)
1193 {
1194 return xfrm_route_forward(skb, AF_INET6);
1195 }
1196
1197 int __xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk);
1198
xfrm_sk_clone_policy(struct sock * sk,const struct sock * osk)1199 static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk)
1200 {
1201 sk->sk_policy[0] = NULL;
1202 sk->sk_policy[1] = NULL;
1203 if (unlikely(osk->sk_policy[0] || osk->sk_policy[1]))
1204 return __xfrm_sk_clone_policy(sk, osk);
1205 return 0;
1206 }
1207
1208 int xfrm_policy_delete(struct xfrm_policy *pol, int dir);
1209
xfrm_sk_free_policy(struct sock * sk)1210 static inline void xfrm_sk_free_policy(struct sock *sk)
1211 {
1212 struct xfrm_policy *pol;
1213
1214 pol = rcu_dereference_protected(sk->sk_policy[0], 1);
1215 if (unlikely(pol != NULL)) {
1216 xfrm_policy_delete(pol, XFRM_POLICY_MAX);
1217 sk->sk_policy[0] = NULL;
1218 }
1219 pol = rcu_dereference_protected(sk->sk_policy[1], 1);
1220 if (unlikely(pol != NULL)) {
1221 xfrm_policy_delete(pol, XFRM_POLICY_MAX+1);
1222 sk->sk_policy[1] = NULL;
1223 }
1224 }
1225
1226 #else
1227
xfrm_sk_free_policy(struct sock * sk)1228 static inline void xfrm_sk_free_policy(struct sock *sk) {}
xfrm_sk_clone_policy(struct sock * sk,const struct sock * osk)1229 static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk) { return 0; }
xfrm6_route_forward(struct sk_buff * skb)1230 static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; }
xfrm4_route_forward(struct sk_buff * skb)1231 static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; }
xfrm6_policy_check(struct sock * sk,int dir,struct sk_buff * skb)1232 static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1233 {
1234 return 1;
1235 }
xfrm4_policy_check(struct sock * sk,int dir,struct sk_buff * skb)1236 static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1237 {
1238 return 1;
1239 }
xfrm_policy_check(struct sock * sk,int dir,struct sk_buff * skb,unsigned short family)1240 static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
1241 {
1242 return 1;
1243 }
xfrm_decode_session_reverse(struct sk_buff * skb,struct flowi * fl,unsigned int family)1244 static inline int xfrm_decode_session_reverse(struct sk_buff *skb,
1245 struct flowi *fl,
1246 unsigned int family)
1247 {
1248 return -ENOSYS;
1249 }
xfrm4_policy_check_reverse(struct sock * sk,int dir,struct sk_buff * skb)1250 static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
1251 struct sk_buff *skb)
1252 {
1253 return 1;
1254 }
xfrm6_policy_check_reverse(struct sock * sk,int dir,struct sk_buff * skb)1255 static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
1256 struct sk_buff *skb)
1257 {
1258 return 1;
1259 }
1260 #endif
1261
1262 static __inline__
xfrm_flowi_daddr(const struct flowi * fl,unsigned short family)1263 xfrm_address_t *xfrm_flowi_daddr(const struct flowi *fl, unsigned short family)
1264 {
1265 switch (family){
1266 case AF_INET:
1267 return (xfrm_address_t *)&fl->u.ip4.daddr;
1268 case AF_INET6:
1269 return (xfrm_address_t *)&fl->u.ip6.daddr;
1270 }
1271 return NULL;
1272 }
1273
1274 static __inline__
xfrm_flowi_saddr(const struct flowi * fl,unsigned short family)1275 xfrm_address_t *xfrm_flowi_saddr(const struct flowi *fl, unsigned short family)
1276 {
1277 switch (family){
1278 case AF_INET:
1279 return (xfrm_address_t *)&fl->u.ip4.saddr;
1280 case AF_INET6:
1281 return (xfrm_address_t *)&fl->u.ip6.saddr;
1282 }
1283 return NULL;
1284 }
1285
1286 static __inline__
xfrm_flowi_addr_get(const struct flowi * fl,xfrm_address_t * saddr,xfrm_address_t * daddr,unsigned short family)1287 void xfrm_flowi_addr_get(const struct flowi *fl,
1288 xfrm_address_t *saddr, xfrm_address_t *daddr,
1289 unsigned short family)
1290 {
1291 switch(family) {
1292 case AF_INET:
1293 memcpy(&saddr->a4, &fl->u.ip4.saddr, sizeof(saddr->a4));
1294 memcpy(&daddr->a4, &fl->u.ip4.daddr, sizeof(daddr->a4));
1295 break;
1296 case AF_INET6:
1297 saddr->in6 = fl->u.ip6.saddr;
1298 daddr->in6 = fl->u.ip6.daddr;
1299 break;
1300 }
1301 }
1302
1303 static __inline__ int
__xfrm4_state_addr_check(const struct xfrm_state * x,const xfrm_address_t * daddr,const xfrm_address_t * saddr)1304 __xfrm4_state_addr_check(const struct xfrm_state *x,
1305 const xfrm_address_t *daddr, const xfrm_address_t *saddr)
1306 {
1307 if (daddr->a4 == x->id.daddr.a4 &&
1308 (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4))
1309 return 1;
1310 return 0;
1311 }
1312
1313 static __inline__ int
__xfrm6_state_addr_check(const struct xfrm_state * x,const xfrm_address_t * daddr,const xfrm_address_t * saddr)1314 __xfrm6_state_addr_check(const struct xfrm_state *x,
1315 const xfrm_address_t *daddr, const xfrm_address_t *saddr)
1316 {
1317 if (ipv6_addr_equal((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) &&
1318 (ipv6_addr_equal((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr) ||
1319 ipv6_addr_any((struct in6_addr *)saddr) ||
1320 ipv6_addr_any((struct in6_addr *)&x->props.saddr)))
1321 return 1;
1322 return 0;
1323 }
1324
1325 static __inline__ int
xfrm_state_addr_check(const struct xfrm_state * x,const xfrm_address_t * daddr,const xfrm_address_t * saddr,unsigned short family)1326 xfrm_state_addr_check(const struct xfrm_state *x,
1327 const xfrm_address_t *daddr, const xfrm_address_t *saddr,
1328 unsigned short family)
1329 {
1330 switch (family) {
1331 case AF_INET:
1332 return __xfrm4_state_addr_check(x, daddr, saddr);
1333 case AF_INET6:
1334 return __xfrm6_state_addr_check(x, daddr, saddr);
1335 }
1336 return 0;
1337 }
1338
1339 static __inline__ int
xfrm_state_addr_flow_check(const struct xfrm_state * x,const struct flowi * fl,unsigned short family)1340 xfrm_state_addr_flow_check(const struct xfrm_state *x, const struct flowi *fl,
1341 unsigned short family)
1342 {
1343 switch (family) {
1344 case AF_INET:
1345 return __xfrm4_state_addr_check(x,
1346 (const xfrm_address_t *)&fl->u.ip4.daddr,
1347 (const xfrm_address_t *)&fl->u.ip4.saddr);
1348 case AF_INET6:
1349 return __xfrm6_state_addr_check(x,
1350 (const xfrm_address_t *)&fl->u.ip6.daddr,
1351 (const xfrm_address_t *)&fl->u.ip6.saddr);
1352 }
1353 return 0;
1354 }
1355
xfrm_state_kern(const struct xfrm_state * x)1356 static inline int xfrm_state_kern(const struct xfrm_state *x)
1357 {
1358 return atomic_read(&x->tunnel_users);
1359 }
1360
xfrm_id_proto_valid(u8 proto)1361 static inline bool xfrm_id_proto_valid(u8 proto)
1362 {
1363 switch (proto) {
1364 case IPPROTO_AH:
1365 case IPPROTO_ESP:
1366 case IPPROTO_COMP:
1367 #if IS_ENABLED(CONFIG_IPV6)
1368 case IPPROTO_ROUTING:
1369 case IPPROTO_DSTOPTS:
1370 #endif
1371 return true;
1372 default:
1373 return false;
1374 }
1375 }
1376
1377 /* IPSEC_PROTO_ANY only matches 3 IPsec protocols, 0 could match all. */
xfrm_id_proto_match(u8 proto,u8 userproto)1378 static inline int xfrm_id_proto_match(u8 proto, u8 userproto)
1379 {
1380 return (!userproto || proto == userproto ||
1381 (userproto == IPSEC_PROTO_ANY && (proto == IPPROTO_AH ||
1382 proto == IPPROTO_ESP ||
1383 proto == IPPROTO_COMP)));
1384 }
1385
1386 /*
1387 * xfrm algorithm information
1388 */
1389 struct xfrm_algo_aead_info {
1390 char *geniv;
1391 u16 icv_truncbits;
1392 };
1393
1394 struct xfrm_algo_auth_info {
1395 u16 icv_truncbits;
1396 u16 icv_fullbits;
1397 };
1398
1399 struct xfrm_algo_encr_info {
1400 char *geniv;
1401 u16 blockbits;
1402 u16 defkeybits;
1403 };
1404
1405 struct xfrm_algo_comp_info {
1406 u16 threshold;
1407 };
1408
1409 struct xfrm_algo_desc {
1410 char *name;
1411 char *compat;
1412 u8 available:1;
1413 u8 pfkey_supported:1;
1414 union {
1415 struct xfrm_algo_aead_info aead;
1416 struct xfrm_algo_auth_info auth;
1417 struct xfrm_algo_encr_info encr;
1418 struct xfrm_algo_comp_info comp;
1419 } uinfo;
1420 struct sadb_alg desc;
1421 };
1422
1423 /* XFRM protocol handlers. */
1424 struct xfrm4_protocol {
1425 int (*handler)(struct sk_buff *skb);
1426 int (*input_handler)(struct sk_buff *skb, int nexthdr, __be32 spi,
1427 int encap_type);
1428 int (*cb_handler)(struct sk_buff *skb, int err);
1429 int (*err_handler)(struct sk_buff *skb, u32 info);
1430
1431 struct xfrm4_protocol __rcu *next;
1432 int priority;
1433 };
1434
1435 struct xfrm6_protocol {
1436 int (*handler)(struct sk_buff *skb);
1437 int (*input_handler)(struct sk_buff *skb, int nexthdr, __be32 spi,
1438 int encap_type);
1439 int (*cb_handler)(struct sk_buff *skb, int err);
1440 int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
1441 u8 type, u8 code, int offset, __be32 info);
1442
1443 struct xfrm6_protocol __rcu *next;
1444 int priority;
1445 };
1446
1447 /* XFRM tunnel handlers. */
1448 struct xfrm_tunnel {
1449 int (*handler)(struct sk_buff *skb);
1450 int (*cb_handler)(struct sk_buff *skb, int err);
1451 int (*err_handler)(struct sk_buff *skb, u32 info);
1452
1453 struct xfrm_tunnel __rcu *next;
1454 int priority;
1455 };
1456
1457 struct xfrm6_tunnel {
1458 int (*handler)(struct sk_buff *skb);
1459 int (*cb_handler)(struct sk_buff *skb, int err);
1460 int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
1461 u8 type, u8 code, int offset, __be32 info);
1462 struct xfrm6_tunnel __rcu *next;
1463 int priority;
1464 };
1465
1466 void xfrm_init(void);
1467 void xfrm4_init(void);
1468 int xfrm_state_init(struct net *net);
1469 void xfrm_state_fini(struct net *net);
1470 void xfrm4_state_init(void);
1471 void xfrm4_protocol_init(void);
1472 #ifdef CONFIG_XFRM
1473 int xfrm6_init(void);
1474 void xfrm6_fini(void);
1475 int xfrm6_state_init(void);
1476 void xfrm6_state_fini(void);
1477 int xfrm6_protocol_init(void);
1478 void xfrm6_protocol_fini(void);
1479 #else
xfrm6_init(void)1480 static inline int xfrm6_init(void)
1481 {
1482 return 0;
1483 }
xfrm6_fini(void)1484 static inline void xfrm6_fini(void)
1485 {
1486 ;
1487 }
1488 #endif
1489
1490 #ifdef CONFIG_XFRM_STATISTICS
1491 int xfrm_proc_init(struct net *net);
1492 void xfrm_proc_fini(struct net *net);
1493 #endif
1494
1495 int xfrm_sysctl_init(struct net *net);
1496 #ifdef CONFIG_SYSCTL
1497 void xfrm_sysctl_fini(struct net *net);
1498 #else
xfrm_sysctl_fini(struct net * net)1499 static inline void xfrm_sysctl_fini(struct net *net)
1500 {
1501 }
1502 #endif
1503
1504 void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto,
1505 struct xfrm_address_filter *filter);
1506 int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk,
1507 int (*func)(struct xfrm_state *, int, void*), void *);
1508 void xfrm_state_walk_done(struct xfrm_state_walk *walk, struct net *net);
1509 struct xfrm_state *xfrm_state_alloc(struct net *net);
1510 void xfrm_state_free(struct xfrm_state *x);
1511 struct xfrm_state *xfrm_state_find(const xfrm_address_t *daddr,
1512 const xfrm_address_t *saddr,
1513 const struct flowi *fl,
1514 struct xfrm_tmpl *tmpl,
1515 struct xfrm_policy *pol, int *err,
1516 unsigned short family, u32 if_id);
1517 struct xfrm_state *xfrm_stateonly_find(struct net *net, u32 mark, u32 if_id,
1518 xfrm_address_t *daddr,
1519 xfrm_address_t *saddr,
1520 unsigned short family,
1521 u8 mode, u8 proto, u32 reqid);
1522 struct xfrm_state *xfrm_state_lookup_byspi(struct net *net, __be32 spi,
1523 unsigned short family);
1524 int xfrm_state_check_expire(struct xfrm_state *x);
1525 void xfrm_state_insert(struct xfrm_state *x);
1526 int xfrm_state_add(struct xfrm_state *x);
1527 int xfrm_state_update(struct xfrm_state *x);
1528 struct xfrm_state *xfrm_state_lookup(struct net *net, u32 mark,
1529 const xfrm_address_t *daddr, __be32 spi,
1530 u8 proto, unsigned short family);
1531 struct xfrm_state *xfrm_state_lookup_byaddr(struct net *net, u32 mark,
1532 const xfrm_address_t *daddr,
1533 const xfrm_address_t *saddr,
1534 u8 proto,
1535 unsigned short family);
1536 #ifdef CONFIG_XFRM_SUB_POLICY
1537 void xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n,
1538 unsigned short family);
1539 void xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n,
1540 unsigned short family);
1541 #else
xfrm_tmpl_sort(struct xfrm_tmpl ** d,struct xfrm_tmpl ** s,int n,unsigned short family)1542 static inline void xfrm_tmpl_sort(struct xfrm_tmpl **d, struct xfrm_tmpl **s,
1543 int n, unsigned short family)
1544 {
1545 }
1546
xfrm_state_sort(struct xfrm_state ** d,struct xfrm_state ** s,int n,unsigned short family)1547 static inline void xfrm_state_sort(struct xfrm_state **d, struct xfrm_state **s,
1548 int n, unsigned short family)
1549 {
1550 }
1551 #endif
1552
1553 struct xfrmk_sadinfo {
1554 u32 sadhcnt; /* current hash bkts */
1555 u32 sadhmcnt; /* max allowed hash bkts */
1556 u32 sadcnt; /* current running count */
1557 };
1558
1559 struct xfrmk_spdinfo {
1560 u32 incnt;
1561 u32 outcnt;
1562 u32 fwdcnt;
1563 u32 inscnt;
1564 u32 outscnt;
1565 u32 fwdscnt;
1566 u32 spdhcnt;
1567 u32 spdhmcnt;
1568 };
1569
1570 struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq);
1571 int xfrm_state_delete(struct xfrm_state *x);
1572 int xfrm_state_flush(struct net *net, u8 proto, bool task_valid, bool sync);
1573 int xfrm_dev_state_flush(struct net *net, struct net_device *dev, bool task_valid);
1574 void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si);
1575 void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si);
1576 u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq);
1577 int xfrm_init_replay(struct xfrm_state *x);
1578 u32 xfrm_state_mtu(struct xfrm_state *x, int mtu);
1579 int __xfrm_init_state(struct xfrm_state *x, bool init_replay, bool offload);
1580 int xfrm_init_state(struct xfrm_state *x);
1581 int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type);
1582 int xfrm_input_resume(struct sk_buff *skb, int nexthdr);
1583 int xfrm_trans_queue_net(struct net *net, struct sk_buff *skb,
1584 int (*finish)(struct net *, struct sock *,
1585 struct sk_buff *));
1586 int xfrm_trans_queue(struct sk_buff *skb,
1587 int (*finish)(struct net *, struct sock *,
1588 struct sk_buff *));
1589 int xfrm_output_resume(struct sock *sk, struct sk_buff *skb, int err);
1590 int xfrm_output(struct sock *sk, struct sk_buff *skb);
1591
1592 #if IS_ENABLED(CONFIG_NET_PKTGEN)
1593 int pktgen_xfrm_outer_mode_output(struct xfrm_state *x, struct sk_buff *skb);
1594 #endif
1595
1596 void xfrm_local_error(struct sk_buff *skb, int mtu);
1597 int xfrm4_extract_input(struct xfrm_state *x, struct sk_buff *skb);
1598 int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi,
1599 int encap_type);
1600 int xfrm4_transport_finish(struct sk_buff *skb, int async);
1601 int xfrm4_rcv(struct sk_buff *skb);
1602 int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq);
1603
xfrm4_rcv_spi(struct sk_buff * skb,int nexthdr,__be32 spi)1604 static inline int xfrm4_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi)
1605 {
1606 XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL;
1607 XFRM_SPI_SKB_CB(skb)->family = AF_INET;
1608 XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr);
1609 return xfrm_input(skb, nexthdr, spi, 0);
1610 }
1611
1612 int xfrm4_output(struct net *net, struct sock *sk, struct sk_buff *skb);
1613 int xfrm4_output_finish(struct sock *sk, struct sk_buff *skb);
1614 int xfrm4_protocol_register(struct xfrm4_protocol *handler, unsigned char protocol);
1615 int xfrm4_protocol_deregister(struct xfrm4_protocol *handler, unsigned char protocol);
1616 int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family);
1617 int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family);
1618 void xfrm4_local_error(struct sk_buff *skb, u32 mtu);
1619 int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb);
1620 int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi,
1621 struct ip6_tnl *t);
1622 int xfrm6_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi,
1623 int encap_type);
1624 int xfrm6_transport_finish(struct sk_buff *skb, int async);
1625 int xfrm6_rcv_tnl(struct sk_buff *skb, struct ip6_tnl *t);
1626 int xfrm6_rcv(struct sk_buff *skb);
1627 int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
1628 xfrm_address_t *saddr, u8 proto);
1629 void xfrm6_local_error(struct sk_buff *skb, u32 mtu);
1630 int xfrm6_protocol_register(struct xfrm6_protocol *handler, unsigned char protocol);
1631 int xfrm6_protocol_deregister(struct xfrm6_protocol *handler, unsigned char protocol);
1632 int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family);
1633 int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family);
1634 __be32 xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr);
1635 __be32 xfrm6_tunnel_spi_lookup(struct net *net, const xfrm_address_t *saddr);
1636 int xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb);
1637 int xfrm6_output_finish(struct sock *sk, struct sk_buff *skb);
1638 int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb,
1639 u8 **prevhdr);
1640
1641 #ifdef CONFIG_XFRM
1642 void xfrm6_local_rxpmtu(struct sk_buff *skb, u32 mtu);
1643 int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb);
1644 int xfrm6_udp_encap_rcv(struct sock *sk, struct sk_buff *skb);
1645 int xfrm_user_policy(struct sock *sk, int optname, sockptr_t optval,
1646 int optlen);
1647 #else
xfrm_user_policy(struct sock * sk,int optname,sockptr_t optval,int optlen)1648 static inline int xfrm_user_policy(struct sock *sk, int optname,
1649 sockptr_t optval, int optlen)
1650 {
1651 return -ENOPROTOOPT;
1652 }
1653 #endif
1654
1655 struct dst_entry *__xfrm_dst_lookup(struct net *net, int tos, int oif,
1656 const xfrm_address_t *saddr,
1657 const xfrm_address_t *daddr,
1658 int family, u32 mark);
1659
1660 struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp);
1661
1662 void xfrm_policy_walk_init(struct xfrm_policy_walk *walk, u8 type);
1663 int xfrm_policy_walk(struct net *net, struct xfrm_policy_walk *walk,
1664 int (*func)(struct xfrm_policy *, int, int, void*),
1665 void *);
1666 void xfrm_policy_walk_done(struct xfrm_policy_walk *walk, struct net *net);
1667 int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl);
1668 struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net,
1669 const struct xfrm_mark *mark,
1670 u32 if_id, u8 type, int dir,
1671 struct xfrm_selector *sel,
1672 struct xfrm_sec_ctx *ctx, int delete,
1673 int *err);
1674 struct xfrm_policy *xfrm_policy_byid(struct net *net,
1675 const struct xfrm_mark *mark, u32 if_id,
1676 u8 type, int dir, u32 id, int delete,
1677 int *err);
1678 int xfrm_policy_flush(struct net *net, u8 type, bool task_valid);
1679 void xfrm_policy_hash_rebuild(struct net *net);
1680 u32 xfrm_get_acqseq(void);
1681 int verify_spi_info(u8 proto, u32 min, u32 max);
1682 int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi);
1683 struct xfrm_state *xfrm_find_acq(struct net *net, const struct xfrm_mark *mark,
1684 u8 mode, u32 reqid, u32 if_id, u8 proto,
1685 const xfrm_address_t *daddr,
1686 const xfrm_address_t *saddr, int create,
1687 unsigned short family);
1688 int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol);
1689
1690 #ifdef CONFIG_XFRM_MIGRATE
1691 int km_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
1692 const struct xfrm_migrate *m, int num_bundles,
1693 const struct xfrm_kmaddress *k,
1694 const struct xfrm_encap_tmpl *encap);
1695 struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net,
1696 u32 if_id);
1697 struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x,
1698 struct xfrm_migrate *m,
1699 struct xfrm_encap_tmpl *encap);
1700 int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
1701 struct xfrm_migrate *m, int num_bundles,
1702 struct xfrm_kmaddress *k, struct net *net,
1703 struct xfrm_encap_tmpl *encap, u32 if_id);
1704 #endif
1705
1706 int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
1707 void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 portid);
1708 int km_report(struct net *net, u8 proto, struct xfrm_selector *sel,
1709 xfrm_address_t *addr);
1710
1711 void xfrm_input_init(void);
1712 int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq);
1713
1714 void xfrm_probe_algs(void);
1715 int xfrm_count_pfkey_auth_supported(void);
1716 int xfrm_count_pfkey_enc_supported(void);
1717 struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx);
1718 struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx);
1719 struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id);
1720 struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id);
1721 struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id);
1722 struct xfrm_algo_desc *xfrm_aalg_get_byname(const char *name, int probe);
1723 struct xfrm_algo_desc *xfrm_ealg_get_byname(const char *name, int probe);
1724 struct xfrm_algo_desc *xfrm_calg_get_byname(const char *name, int probe);
1725 struct xfrm_algo_desc *xfrm_aead_get_byname(const char *name, int icv_len,
1726 int probe);
1727
xfrm6_addr_equal(const xfrm_address_t * a,const xfrm_address_t * b)1728 static inline bool xfrm6_addr_equal(const xfrm_address_t *a,
1729 const xfrm_address_t *b)
1730 {
1731 return ipv6_addr_equal((const struct in6_addr *)a,
1732 (const struct in6_addr *)b);
1733 }
1734
xfrm_addr_equal(const xfrm_address_t * a,const xfrm_address_t * b,sa_family_t family)1735 static inline bool xfrm_addr_equal(const xfrm_address_t *a,
1736 const xfrm_address_t *b,
1737 sa_family_t family)
1738 {
1739 switch (family) {
1740 default:
1741 case AF_INET:
1742 return ((__force u32)a->a4 ^ (__force u32)b->a4) == 0;
1743 case AF_INET6:
1744 return xfrm6_addr_equal(a, b);
1745 }
1746 }
1747
xfrm_policy_id2dir(u32 index)1748 static inline int xfrm_policy_id2dir(u32 index)
1749 {
1750 return index & 7;
1751 }
1752
1753 #ifdef CONFIG_XFRM
xfrm_aevent_is_on(struct net * net)1754 static inline int xfrm_aevent_is_on(struct net *net)
1755 {
1756 struct sock *nlsk;
1757 int ret = 0;
1758
1759 rcu_read_lock();
1760 nlsk = rcu_dereference(net->xfrm.nlsk);
1761 if (nlsk)
1762 ret = netlink_has_listeners(nlsk, XFRMNLGRP_AEVENTS);
1763 rcu_read_unlock();
1764 return ret;
1765 }
1766
xfrm_acquire_is_on(struct net * net)1767 static inline int xfrm_acquire_is_on(struct net *net)
1768 {
1769 struct sock *nlsk;
1770 int ret = 0;
1771
1772 rcu_read_lock();
1773 nlsk = rcu_dereference(net->xfrm.nlsk);
1774 if (nlsk)
1775 ret = netlink_has_listeners(nlsk, XFRMNLGRP_ACQUIRE);
1776 rcu_read_unlock();
1777
1778 return ret;
1779 }
1780 #endif
1781
aead_len(struct xfrm_algo_aead * alg)1782 static inline unsigned int aead_len(struct xfrm_algo_aead *alg)
1783 {
1784 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1785 }
1786
xfrm_alg_len(const struct xfrm_algo * alg)1787 static inline unsigned int xfrm_alg_len(const struct xfrm_algo *alg)
1788 {
1789 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1790 }
1791
xfrm_alg_auth_len(const struct xfrm_algo_auth * alg)1792 static inline unsigned int xfrm_alg_auth_len(const struct xfrm_algo_auth *alg)
1793 {
1794 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1795 }
1796
xfrm_replay_state_esn_len(struct xfrm_replay_state_esn * replay_esn)1797 static inline unsigned int xfrm_replay_state_esn_len(struct xfrm_replay_state_esn *replay_esn)
1798 {
1799 return sizeof(*replay_esn) + replay_esn->bmp_len * sizeof(__u32);
1800 }
1801
1802 #ifdef CONFIG_XFRM_MIGRATE
xfrm_replay_clone(struct xfrm_state * x,struct xfrm_state * orig)1803 static inline int xfrm_replay_clone(struct xfrm_state *x,
1804 struct xfrm_state *orig)
1805 {
1806
1807 x->replay_esn = kmemdup(orig->replay_esn,
1808 xfrm_replay_state_esn_len(orig->replay_esn),
1809 GFP_KERNEL);
1810 if (!x->replay_esn)
1811 return -ENOMEM;
1812 x->preplay_esn = kmemdup(orig->preplay_esn,
1813 xfrm_replay_state_esn_len(orig->preplay_esn),
1814 GFP_KERNEL);
1815 if (!x->preplay_esn)
1816 return -ENOMEM;
1817
1818 return 0;
1819 }
1820
xfrm_algo_aead_clone(struct xfrm_algo_aead * orig)1821 static inline struct xfrm_algo_aead *xfrm_algo_aead_clone(struct xfrm_algo_aead *orig)
1822 {
1823 return kmemdup(orig, aead_len(orig), GFP_KERNEL);
1824 }
1825
1826
xfrm_algo_clone(struct xfrm_algo * orig)1827 static inline struct xfrm_algo *xfrm_algo_clone(struct xfrm_algo *orig)
1828 {
1829 return kmemdup(orig, xfrm_alg_len(orig), GFP_KERNEL);
1830 }
1831
xfrm_algo_auth_clone(struct xfrm_algo_auth * orig)1832 static inline struct xfrm_algo_auth *xfrm_algo_auth_clone(struct xfrm_algo_auth *orig)
1833 {
1834 return kmemdup(orig, xfrm_alg_auth_len(orig), GFP_KERNEL);
1835 }
1836
xfrm_states_put(struct xfrm_state ** states,int n)1837 static inline void xfrm_states_put(struct xfrm_state **states, int n)
1838 {
1839 int i;
1840 for (i = 0; i < n; i++)
1841 xfrm_state_put(*(states + i));
1842 }
1843
xfrm_states_delete(struct xfrm_state ** states,int n)1844 static inline void xfrm_states_delete(struct xfrm_state **states, int n)
1845 {
1846 int i;
1847 for (i = 0; i < n; i++)
1848 xfrm_state_delete(*(states + i));
1849 }
1850 #endif
1851
1852 #ifdef CONFIG_XFRM
xfrm_input_state(struct sk_buff * skb)1853 static inline struct xfrm_state *xfrm_input_state(struct sk_buff *skb)
1854 {
1855 struct sec_path *sp = skb_sec_path(skb);
1856
1857 return sp->xvec[sp->len - 1];
1858 }
1859 #endif
1860
xfrm_offload(struct sk_buff * skb)1861 static inline struct xfrm_offload *xfrm_offload(struct sk_buff *skb)
1862 {
1863 #ifdef CONFIG_XFRM
1864 struct sec_path *sp = skb_sec_path(skb);
1865
1866 if (!sp || !sp->olen || sp->len != sp->olen)
1867 return NULL;
1868
1869 return &sp->ovec[sp->olen - 1];
1870 #else
1871 return NULL;
1872 #endif
1873 }
1874
1875 void __init xfrm_dev_init(void);
1876
1877 #ifdef CONFIG_XFRM_OFFLOAD
1878 void xfrm_dev_resume(struct sk_buff *skb);
1879 void xfrm_dev_backlog(struct softnet_data *sd);
1880 struct sk_buff *validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t features, bool *again);
1881 int xfrm_dev_state_add(struct net *net, struct xfrm_state *x,
1882 struct xfrm_user_offload *xuo);
1883 bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x);
1884
xfrm_dev_state_advance_esn(struct xfrm_state * x)1885 static inline void xfrm_dev_state_advance_esn(struct xfrm_state *x)
1886 {
1887 struct xfrm_state_offload *xso = &x->xso;
1888
1889 if (xso->dev && xso->dev->xfrmdev_ops->xdo_dev_state_advance_esn)
1890 xso->dev->xfrmdev_ops->xdo_dev_state_advance_esn(x);
1891 }
1892
xfrm_dst_offload_ok(struct dst_entry * dst)1893 static inline bool xfrm_dst_offload_ok(struct dst_entry *dst)
1894 {
1895 struct xfrm_state *x = dst->xfrm;
1896 struct xfrm_dst *xdst;
1897
1898 if (!x || !x->type_offload)
1899 return false;
1900
1901 xdst = (struct xfrm_dst *) dst;
1902 if (!x->xso.offload_handle && !xdst->child->xfrm)
1903 return true;
1904 if (x->xso.offload_handle && (x->xso.dev == xfrm_dst_path(dst)->dev) &&
1905 !xdst->child->xfrm)
1906 return true;
1907
1908 return false;
1909 }
1910
xfrm_dev_state_delete(struct xfrm_state * x)1911 static inline void xfrm_dev_state_delete(struct xfrm_state *x)
1912 {
1913 struct xfrm_state_offload *xso = &x->xso;
1914
1915 if (xso->dev)
1916 xso->dev->xfrmdev_ops->xdo_dev_state_delete(x);
1917 }
1918
xfrm_dev_state_free(struct xfrm_state * x)1919 static inline void xfrm_dev_state_free(struct xfrm_state *x)
1920 {
1921 struct xfrm_state_offload *xso = &x->xso;
1922 struct net_device *dev = xso->dev;
1923
1924 if (dev && dev->xfrmdev_ops) {
1925 if (dev->xfrmdev_ops->xdo_dev_state_free)
1926 dev->xfrmdev_ops->xdo_dev_state_free(x);
1927 xso->dev = NULL;
1928 dev_put(dev);
1929 }
1930 }
1931 #else
xfrm_dev_resume(struct sk_buff * skb)1932 static inline void xfrm_dev_resume(struct sk_buff *skb)
1933 {
1934 }
1935
xfrm_dev_backlog(struct softnet_data * sd)1936 static inline void xfrm_dev_backlog(struct softnet_data *sd)
1937 {
1938 }
1939
validate_xmit_xfrm(struct sk_buff * skb,netdev_features_t features,bool * again)1940 static inline struct sk_buff *validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t features, bool *again)
1941 {
1942 return skb;
1943 }
1944
xfrm_dev_state_add(struct net * net,struct xfrm_state * x,struct xfrm_user_offload * xuo)1945 static inline int xfrm_dev_state_add(struct net *net, struct xfrm_state *x, struct xfrm_user_offload *xuo)
1946 {
1947 return 0;
1948 }
1949
xfrm_dev_state_delete(struct xfrm_state * x)1950 static inline void xfrm_dev_state_delete(struct xfrm_state *x)
1951 {
1952 }
1953
xfrm_dev_state_free(struct xfrm_state * x)1954 static inline void xfrm_dev_state_free(struct xfrm_state *x)
1955 {
1956 }
1957
xfrm_dev_offload_ok(struct sk_buff * skb,struct xfrm_state * x)1958 static inline bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x)
1959 {
1960 return false;
1961 }
1962
xfrm_dev_state_advance_esn(struct xfrm_state * x)1963 static inline void xfrm_dev_state_advance_esn(struct xfrm_state *x)
1964 {
1965 }
1966
xfrm_dst_offload_ok(struct dst_entry * dst)1967 static inline bool xfrm_dst_offload_ok(struct dst_entry *dst)
1968 {
1969 return false;
1970 }
1971 #endif
1972
xfrm_mark_get(struct nlattr ** attrs,struct xfrm_mark * m)1973 static inline int xfrm_mark_get(struct nlattr **attrs, struct xfrm_mark *m)
1974 {
1975 if (attrs[XFRMA_MARK])
1976 memcpy(m, nla_data(attrs[XFRMA_MARK]), sizeof(struct xfrm_mark));
1977 else
1978 m->v = m->m = 0;
1979
1980 return m->v & m->m;
1981 }
1982
xfrm_mark_put(struct sk_buff * skb,const struct xfrm_mark * m)1983 static inline int xfrm_mark_put(struct sk_buff *skb, const struct xfrm_mark *m)
1984 {
1985 int ret = 0;
1986
1987 if (m->m | m->v)
1988 ret = nla_put(skb, XFRMA_MARK, sizeof(struct xfrm_mark), m);
1989 return ret;
1990 }
1991
xfrm_smark_get(__u32 mark,struct xfrm_state * x)1992 static inline __u32 xfrm_smark_get(__u32 mark, struct xfrm_state *x)
1993 {
1994 struct xfrm_mark *m = &x->props.smark;
1995
1996 return (m->v & m->m) | (mark & ~m->m);
1997 }
1998
xfrm_if_id_put(struct sk_buff * skb,__u32 if_id)1999 static inline int xfrm_if_id_put(struct sk_buff *skb, __u32 if_id)
2000 {
2001 int ret = 0;
2002
2003 if (if_id)
2004 ret = nla_put_u32(skb, XFRMA_IF_ID, if_id);
2005 return ret;
2006 }
2007
xfrm_tunnel_check(struct sk_buff * skb,struct xfrm_state * x,unsigned int family)2008 static inline int xfrm_tunnel_check(struct sk_buff *skb, struct xfrm_state *x,
2009 unsigned int family)
2010 {
2011 bool tunnel = false;
2012
2013 switch(family) {
2014 case AF_INET:
2015 if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4)
2016 tunnel = true;
2017 break;
2018 case AF_INET6:
2019 if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6)
2020 tunnel = true;
2021 break;
2022 }
2023 if (tunnel && !(x->outer_mode.flags & XFRM_MODE_FLAG_TUNNEL))
2024 return -EINVAL;
2025
2026 return 0;
2027 }
2028
2029 extern const int xfrm_msg_min[XFRM_NR_MSGTYPES];
2030 extern const struct nla_policy xfrma_policy[XFRMA_MAX+1];
2031
2032 struct xfrm_translator {
2033 /* Allocate frag_list and put compat translation there */
2034 int (*alloc_compat)(struct sk_buff *skb, const struct nlmsghdr *src);
2035
2036 /* Allocate nlmsg with 64-bit translaton of received 32-bit message */
2037 struct nlmsghdr *(*rcv_msg_compat)(const struct nlmsghdr *nlh,
2038 int maxtype, const struct nla_policy *policy,
2039 struct netlink_ext_ack *extack);
2040
2041 /* Translate 32-bit user_policy from sockptr */
2042 int (*xlate_user_policy_sockptr)(u8 **pdata32, int optlen);
2043
2044 struct module *owner;
2045 };
2046
2047 #if IS_ENABLED(CONFIG_XFRM_USER_COMPAT)
2048 extern int xfrm_register_translator(struct xfrm_translator *xtr);
2049 extern int xfrm_unregister_translator(struct xfrm_translator *xtr);
2050 extern struct xfrm_translator *xfrm_get_translator(void);
2051 extern void xfrm_put_translator(struct xfrm_translator *xtr);
2052 #else
xfrm_get_translator(void)2053 static inline struct xfrm_translator *xfrm_get_translator(void)
2054 {
2055 return NULL;
2056 }
xfrm_put_translator(struct xfrm_translator * xtr)2057 static inline void xfrm_put_translator(struct xfrm_translator *xtr)
2058 {
2059 }
2060 #endif
2061
2062 #if IS_ENABLED(CONFIG_IPV6)
xfrm6_local_dontfrag(const struct sock * sk)2063 static inline bool xfrm6_local_dontfrag(const struct sock *sk)
2064 {
2065 int proto;
2066
2067 if (!sk || sk->sk_family != AF_INET6)
2068 return false;
2069
2070 proto = sk->sk_protocol;
2071 if (proto == IPPROTO_UDP || proto == IPPROTO_RAW)
2072 return inet6_sk(sk)->dontfrag;
2073
2074 return false;
2075 }
2076 #endif
2077 #endif /* _NET_XFRM_H */
2078