1/* SPDX-License-Identifier: GPL-2.0 */
   2#ifndef _NET_XFRM_H
   3#define _NET_XFRM_H
   4
   5#include <linux/compiler.h>
   6#include <linux/xfrm.h>
   7#include <linux/spinlock.h>
   8#include <linux/list.h>
   9#include <linux/skbuff.h>
  10#include <linux/socket.h>
  11#include <linux/pfkeyv2.h>
  12#include <linux/ipsec.h>
  13#include <linux/in6.h>
  14#include <linux/mutex.h>
  15#include <linux/audit.h>
  16#include <linux/slab.h>
  17#include <linux/refcount.h>
  18#include <linux/sockptr.h>
  19
  20#include <net/sock.h>
  21#include <net/dst.h>
  22#include <net/inet_dscp.h>
  23#include <net/ip.h>
  24#include <net/route.h>
  25#include <net/ipv6.h>
  26#include <net/ip6_fib.h>
  27#include <net/flow.h>
  28#include <net/gro_cells.h>
  29
  30#include <linux/interrupt.h>
  31
  32#ifdef CONFIG_XFRM_STATISTICS
  33#include <net/snmp.h>
  34#endif
  35
  36#define XFRM_PROTO_ESP		50
  37#define XFRM_PROTO_AH		51
  38#define XFRM_PROTO_COMP		108
  39#define XFRM_PROTO_IPIP		4
  40#define XFRM_PROTO_IPV6		41
  41#define XFRM_PROTO_ROUTING	IPPROTO_ROUTING
  42#define XFRM_PROTO_DSTOPTS	IPPROTO_DSTOPTS
  43
  44#define XFRM_ALIGN4(len)	(((len) + 3) & ~3)
  45#define XFRM_ALIGN8(len)	(((len) + 7) & ~7)
  46#define MODULE_ALIAS_XFRM_MODE(family, encap) \
  47	MODULE_ALIAS("xfrm-mode-" __stringify(family) "-" __stringify(encap))
  48#define MODULE_ALIAS_XFRM_TYPE(family, proto) \
  49	MODULE_ALIAS("xfrm-type-" __stringify(family) "-" __stringify(proto))
  50#define MODULE_ALIAS_XFRM_OFFLOAD_TYPE(family, proto) \
  51	MODULE_ALIAS("xfrm-offload-" __stringify(family) "-" __stringify(proto))
  52
  53#ifdef CONFIG_XFRM_STATISTICS
  54#define XFRM_INC_STATS(net, field)	SNMP_INC_STATS((net)->mib.xfrm_statistics, field)
  55#define XFRM_ADD_STATS(net, field, val) SNMP_ADD_STATS((net)->mib.xfrm_statistics, field, val)
 
  56#else
  57#define XFRM_INC_STATS(net, field)	((void)(net))
  58#define XFRM_ADD_STATS(net, field, val) ((void)(net))
 
  59#endif
  60
 
  61
  62/* Organization of SPD aka "XFRM rules"
  63   ------------------------------------
  64
  65   Basic objects:
  66   - policy rule, struct xfrm_policy (=SPD entry)
  67   - bundle of transformations, struct dst_entry == struct xfrm_dst (=SA bundle)
  68   - instance of a transformer, struct xfrm_state (=SA)
  69   - template to clone xfrm_state, struct xfrm_tmpl
  70
  71   SPD is organized as hash table (for policies that meet minimum address prefix
  72   length setting, net->xfrm.policy_hthresh).  Other policies are stored in
  73   lists, sorted into rbtree ordered by destination and source address networks.
  74   See net/xfrm/xfrm_policy.c for details.
  75
  76   (To be compatible with existing pfkeyv2 implementations,
  77   many rules with priority of 0x7fffffff are allowed to exist and
  78   such rules are ordered in an unpredictable way, thanks to bsd folks.)
  79
 
 
  80   If "action" is "block", then we prohibit the flow, otherwise:
  81   if "xfrms_nr" is zero, the flow passes untransformed. Otherwise,
  82   policy entry has list of up to XFRM_MAX_DEPTH transformations,
  83   described by templates xfrm_tmpl. Each template is resolved
  84   to a complete xfrm_state (see below) and we pack bundle of transformations
  85   to a dst_entry returned to requester.
  86
  87   dst -. xfrm  .-> xfrm_state #1
  88    |---. child .-> dst -. xfrm .-> xfrm_state #2
  89                     |---. child .-> dst -. xfrm .-> xfrm_state #3
  90                                      |---. child .-> NULL
  91
 
 
  92
  93   Resolution of xrfm_tmpl
  94   -----------------------
  95   Template contains:
  96   1. ->mode		Mode: transport or tunnel
  97   2. ->id.proto	Protocol: AH/ESP/IPCOMP
  98   3. ->id.daddr	Remote tunnel endpoint, ignored for transport mode.
  99      Q: allow to resolve security gateway?
 100   4. ->id.spi          If not zero, static SPI.
 101   5. ->saddr		Local tunnel endpoint, ignored for transport mode.
 102   6. ->algos		List of allowed algos. Plain bitmask now.
 103      Q: ealgos, aalgos, calgos. What a mess...
 104   7. ->share		Sharing mode.
 105      Q: how to implement private sharing mode? To add struct sock* to
 106      flow id?
 107
 108   Having this template we search through SAD searching for entries
 109   with appropriate mode/proto/algo, permitted by selector.
 110   If no appropriate entry found, it is requested from key manager.
 111
 112   PROBLEMS:
 113   Q: How to find all the bundles referring to a physical path for
 114      PMTU discovery? Seems, dst should contain list of all parents...
 115      and enter to infinite locking hierarchy disaster.
 116      No! It is easier, we will not search for them, let them find us.
 117      We add genid to each dst plus pointer to genid of raw IP route,
 118      pmtu disc will update pmtu on raw IP route and increase its genid.
 119      dst_check() will see this for top level and trigger resyncing
 120      metrics. Plus, it will be made via sk->sk_dst_cache. Solved.
 121 */
 122
 123struct xfrm_state_walk {
 124	struct list_head	all;
 125	u8			state;
 126	u8			dying;
 127	u8			proto;
 
 
 128	u32			seq;
 129	struct xfrm_address_filter *filter;
 130};
 131
 132enum {
 133	XFRM_DEV_OFFLOAD_IN = 1,
 134	XFRM_DEV_OFFLOAD_OUT,
 135	XFRM_DEV_OFFLOAD_FWD,
 136};
 137
 138enum {
 139	XFRM_DEV_OFFLOAD_UNSPECIFIED,
 140	XFRM_DEV_OFFLOAD_CRYPTO,
 141	XFRM_DEV_OFFLOAD_PACKET,
 142};
 143
 144enum {
 145	XFRM_DEV_OFFLOAD_FLAG_ACQ = 1,
 146};
 147
 148struct xfrm_dev_offload {
 149	struct net_device	*dev;
 150	netdevice_tracker	dev_tracker;
 151	struct net_device	*real_dev;
 152	unsigned long		offload_handle;
 153	u8			dir : 2;
 154	u8			type : 2;
 155	u8			flags : 2;
 156};
 157
 158struct xfrm_mode {
 159	u8 encap;
 160	u8 family;
 161	u8 flags;
 162};
 163
 164/* Flags for xfrm_mode. */
 165enum {
 166	XFRM_MODE_FLAG_TUNNEL = 1,
 167};
 168
 169enum xfrm_replay_mode {
 170	XFRM_REPLAY_MODE_LEGACY,
 171	XFRM_REPLAY_MODE_BMP,
 172	XFRM_REPLAY_MODE_ESN,
 173};
 174
 175/* Full description of state of transformer. */
 176struct xfrm_state {
 177	possible_net_t		xs_net;
 
 
 178	union {
 179		struct hlist_node	gclist;
 180		struct hlist_node	bydst;
 181	};
 182	union {
 183		struct hlist_node	dev_gclist;
 184		struct hlist_node	bysrc;
 185	};
 186	struct hlist_node	byspi;
 187	struct hlist_node	byseq;
 188	struct hlist_node	state_cache;
 189	struct hlist_node	state_cache_input;
 190
 191	refcount_t		refcnt;
 192	spinlock_t		lock;
 193
 194	u32			pcpu_num;
 195	struct xfrm_id		id;
 196	struct xfrm_selector	sel;
 197	struct xfrm_mark	mark;
 198	u32			if_id;
 199	u32			tfcpad;
 200
 201	u32			genid;
 202
 203	/* Key manager bits */
 204	struct xfrm_state_walk	km;
 205
 206	/* Parameters of this state. */
 207	struct {
 208		u32		reqid;
 209		u8		mode;
 210		u8		replay_window;
 211		u8		aalgo, ealgo, calgo;
 212		u8		flags;
 213		u16		family;
 214		xfrm_address_t	saddr;
 215		int		header_len;
 216		int		trailer_len;
 217		u32		extra_flags;
 218		struct xfrm_mark	smark;
 219	} props;
 220
 221	struct xfrm_lifetime_cfg lft;
 222
 223	/* Data for transformer */
 224	struct xfrm_algo_auth	*aalg;
 225	struct xfrm_algo	*ealg;
 226	struct xfrm_algo	*calg;
 227	struct xfrm_algo_aead	*aead;
 228	const char		*geniv;
 229
 230	/* mapping change rate limiting */
 231	__be16 new_mapping_sport;
 232	u32 new_mapping;	/* seconds */
 233	u32 mapping_maxage;	/* seconds for input SA */
 234
 235	/* Data for encapsulator */
 236	struct xfrm_encap_tmpl	*encap;
 237	struct sock __rcu	*encap_sk;
 238
 239	/* NAT keepalive */
 240	u32			nat_keepalive_interval; /* seconds */
 241	time64_t		nat_keepalive_expiration;
 242
 243	/* Data for care-of address */
 244	xfrm_address_t	*coaddr;
 245
 246	/* IPComp needs an IPIP tunnel for handling uncompressed packets */
 247	struct xfrm_state	*tunnel;
 248
 249	/* If a tunnel, number of users + 1 */
 250	atomic_t		tunnel_users;
 251
 252	/* State for replay detection */
 253	struct xfrm_replay_state replay;
 254	struct xfrm_replay_state_esn *replay_esn;
 255
 256	/* Replay detection state at the time we sent the last notification */
 257	struct xfrm_replay_state preplay;
 258	struct xfrm_replay_state_esn *preplay_esn;
 259
 260	/* replay detection mode */
 261	enum xfrm_replay_mode    repl_mode;
 
 262	/* internal flag that only holds state for delayed aevent at the
 263	 * moment
 264	*/
 265	u32			xflags;
 266
 267	/* Replay detection notification settings */
 268	u32			replay_maxage;
 269	u32			replay_maxdiff;
 270
 271	/* Replay detection notification timer */
 272	struct timer_list	rtimer;
 273
 274	/* Statistics */
 275	struct xfrm_stats	stats;
 276
 277	struct xfrm_lifetime_cur curlft;
 278	struct hrtimer		mtimer;
 279
 280	struct xfrm_dev_offload xso;
 281
 282	/* used to fix curlft->add_time when changing date */
 283	long		saved_tmo;
 284
 285	/* Last used time */
 286	time64_t		lastused;
 287
 288	struct page_frag xfrag;
 289
 290	/* Reference to data common to all the instances of this
 291	 * transformer. */
 292	const struct xfrm_type	*type;
 293	struct xfrm_mode	inner_mode;
 294	struct xfrm_mode	inner_mode_iaf;
 295	struct xfrm_mode	outer_mode;
 296
 297	const struct xfrm_type_offload	*type_offload;
 298
 299	/* Security context */
 300	struct xfrm_sec_ctx	*security;
 301
 302	/* Private data of this transformer, format is opaque,
 303	 * interpreted by xfrm_type methods. */
 304	void			*data;
 305	u8			dir;
 306};
 307
 308static inline struct net *xs_net(struct xfrm_state *x)
 309{
 310	return read_pnet(&x->xs_net);
 311}
 312
 313/* xflags - make enum if more show up */
 314#define XFRM_TIME_DEFER	1
 315#define XFRM_SOFT_EXPIRE 2
 316
 317enum {
 318	XFRM_STATE_VOID,
 319	XFRM_STATE_ACQ,
 320	XFRM_STATE_VALID,
 321	XFRM_STATE_ERROR,
 322	XFRM_STATE_EXPIRED,
 323	XFRM_STATE_DEAD
 324};
 325
 326/* callback structure passed from either netlink or pfkey */
 327struct km_event {
 328	union {
 329		u32 hard;
 330		u32 proto;
 331		u32 byid;
 332		u32 aevent;
 333		u32 type;
 334	} data;
 335
 336	u32	seq;
 337	u32	portid;
 338	u32	event;
 339	struct net *net;
 340};
 341
 342struct xfrm_if_decode_session_result {
 343	struct net *net;
 344	u32 if_id;
 345};
 346
 347struct xfrm_if_cb {
 348	bool (*decode_session)(struct sk_buff *skb,
 349			       unsigned short family,
 350			       struct xfrm_if_decode_session_result *res);
 351};
 352
 353void xfrm_if_register_cb(const struct xfrm_if_cb *ifcb);
 354void xfrm_if_unregister_cb(void);
 355
 356struct xfrm_dst_lookup_params {
 357	struct net *net;
 358	dscp_t dscp;
 359	int oif;
 360	xfrm_address_t *saddr;
 361	xfrm_address_t *daddr;
 362	u32 mark;
 363	__u8 ipproto;
 364	union flowi_uli uli;
 365};
 366
 367struct net_device;
 368struct xfrm_type;
 369struct xfrm_dst;
 370struct xfrm_policy_afinfo {
 
 371	struct dst_ops		*dst_ops;
 372	struct dst_entry	*(*dst_lookup)(const struct xfrm_dst_lookup_params *params);
 373	int			(*get_saddr)(xfrm_address_t *saddr,
 374					     const struct xfrm_dst_lookup_params *params);
 
 
 
 
 
 
 
 
 
 375	int			(*fill_dst)(struct xfrm_dst *xdst,
 376					    struct net_device *dev,
 377					    const struct flowi *fl);
 378	struct dst_entry	*(*blackhole_route)(struct net *net, struct dst_entry *orig);
 379};
 380
 381int xfrm_policy_register_afinfo(const struct xfrm_policy_afinfo *afinfo, int family);
 382void xfrm_policy_unregister_afinfo(const struct xfrm_policy_afinfo *afinfo);
 383void km_policy_notify(struct xfrm_policy *xp, int dir,
 384		      const struct km_event *c);
 385void km_state_notify(struct xfrm_state *x, const struct km_event *c);
 386
 387struct xfrm_tmpl;
 388int km_query(struct xfrm_state *x, struct xfrm_tmpl *t,
 389	     struct xfrm_policy *pol);
 390void km_state_expired(struct xfrm_state *x, int hard, u32 portid);
 391int __xfrm_state_delete(struct xfrm_state *x);
 392
 393struct xfrm_state_afinfo {
 394	u8				family;
 395	u8				proto;
 396
 397	const struct xfrm_type_offload *type_offload_esp;
 398
 399	const struct xfrm_type		*type_esp;
 400	const struct xfrm_type		*type_ipip;
 401	const struct xfrm_type		*type_ipip6;
 402	const struct xfrm_type		*type_comp;
 403	const struct xfrm_type		*type_ah;
 404	const struct xfrm_type		*type_routing;
 405	const struct xfrm_type		*type_dstopts;
 406
 407	int			(*output)(struct net *net, struct sock *sk, struct sk_buff *skb);
 
 
 
 
 
 
 
 408	int			(*transport_finish)(struct sk_buff *skb,
 409						    int async);
 410	void			(*local_error)(struct sk_buff *skb, u32 mtu);
 411};
 412
 413int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo);
 414int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo);
 415struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family);
 416struct xfrm_state_afinfo *xfrm_state_afinfo_get_rcu(unsigned int family);
 417
 418struct xfrm_input_afinfo {
 419	u8			family;
 420	bool			is_ipip;
 421	int			(*callback)(struct sk_buff *skb, u8 protocol,
 422					    int err);
 423};
 424
 425int xfrm_input_register_afinfo(const struct xfrm_input_afinfo *afinfo);
 426int xfrm_input_unregister_afinfo(const struct xfrm_input_afinfo *afinfo);
 427
 428void xfrm_flush_gc(void);
 429void xfrm_state_delete_tunnel(struct xfrm_state *x);
 430
 431struct xfrm_type {
 
 432	struct module		*owner;
 433	u8			proto;
 434	u8			flags;
 435#define XFRM_TYPE_NON_FRAGMENT	1
 436#define XFRM_TYPE_REPLAY_PROT	2
 437#define XFRM_TYPE_LOCAL_COADDR	4
 438#define XFRM_TYPE_REMOTE_COADDR	8
 439
 440	int			(*init_state)(struct xfrm_state *x,
 441					      struct netlink_ext_ack *extack);
 442	void			(*destructor)(struct xfrm_state *);
 443	int			(*input)(struct xfrm_state *, struct sk_buff *skb);
 444	int			(*output)(struct xfrm_state *, struct sk_buff *pskb);
 445	int			(*reject)(struct xfrm_state *, struct sk_buff *,
 446					  const struct flowi *);
 
 
 
 447};
 448
 449int xfrm_register_type(const struct xfrm_type *type, unsigned short family);
 450void xfrm_unregister_type(const struct xfrm_type *type, unsigned short family);
 451
 452struct xfrm_type_offload {
 453	struct module	*owner;
 454	u8		proto;
 455	void		(*encap)(struct xfrm_state *, struct sk_buff *pskb);
 456	int		(*input_tail)(struct xfrm_state *x, struct sk_buff *skb);
 457	int		(*xmit)(struct xfrm_state *, struct sk_buff *pskb, netdev_features_t features);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 458};
 459
 460int xfrm_register_type_offload(const struct xfrm_type_offload *type, unsigned short family);
 461void xfrm_unregister_type_offload(const struct xfrm_type_offload *type, unsigned short family);
 
 
 
 
 
 462
 463static inline int xfrm_af2proto(unsigned int family)
 464{
 465	switch(family) {
 466	case AF_INET:
 467		return IPPROTO_IPIP;
 468	case AF_INET6:
 469		return IPPROTO_IPV6;
 470	default:
 471		return 0;
 472	}
 473}
 474
 475static inline const struct xfrm_mode *xfrm_ip2inner_mode(struct xfrm_state *x, int ipproto)
 476{
 477	if ((ipproto == IPPROTO_IPIP && x->props.family == AF_INET) ||
 478	    (ipproto == IPPROTO_IPV6 && x->props.family == AF_INET6))
 479		return &x->inner_mode;
 480	else
 481		return &x->inner_mode_iaf;
 482}
 483
 484struct xfrm_tmpl {
 485/* id in template is interpreted as:
 486 * daddr - destination of tunnel, may be zero for transport mode.
 487 * spi   - zero to acquire spi. Not zero if spi is static, then
 488 *	   daddr must be fixed too.
 489 * proto - AH/ESP/IPCOMP
 490 */
 491	struct xfrm_id		id;
 492
 493/* Source address of tunnel. Ignored, if it is not a tunnel. */
 494	xfrm_address_t		saddr;
 495
 496	unsigned short		encap_family;
 497
 498	u32			reqid;
 499
 500/* Mode: transport, tunnel etc. */
 501	u8			mode;
 502
 503/* Sharing mode: unique, this session only, this user only etc. */
 504	u8			share;
 505
 506/* May skip this transfomration if no SA is found */
 507	u8			optional;
 508
 509/* Skip aalgos/ealgos/calgos checks. */
 510	u8			allalgs;
 511
 512/* Bit mask of algos allowed for acquisition */
 513	u32			aalgos;
 514	u32			ealgos;
 515	u32			calgos;
 516};
 517
 518#define XFRM_MAX_DEPTH		6
 519#define XFRM_MAX_OFFLOAD_DEPTH	1
 520
 521struct xfrm_policy_walk_entry {
 522	struct list_head	all;
 523	u8			dead;
 524};
 525
 526struct xfrm_policy_walk {
 527	struct xfrm_policy_walk_entry walk;
 528	u8 type;
 529	u32 seq;
 530};
 531
 532struct xfrm_policy_queue {
 533	struct sk_buff_head	hold_queue;
 534	struct timer_list	hold_timer;
 535	unsigned long		timeout;
 536};
 537
 538/**
 539 *	struct xfrm_policy - xfrm policy
 540 *	@xp_net: network namespace the policy lives in
 541 *	@bydst: hlist node for SPD hash table or rbtree list
 542 *	@byidx: hlist node for index hash table
 543 *	@state_cache_list: hlist head for policy cached xfrm states
 544 *	@lock: serialize changes to policy structure members
 545 *	@refcnt: reference count, freed once it reaches 0
 546 *	@pos: kernel internal tie-breaker to determine age of policy
 547 *	@timer: timer
 548 *	@genid: generation, used to invalidate old policies
 549 *	@priority: priority, set by userspace
 550 *	@index:  policy index (autogenerated)
 551 *	@if_id: virtual xfrm interface id
 552 *	@mark: packet mark
 553 *	@selector: selector
 554 *	@lft: liftime configuration data
 555 *	@curlft: liftime state
 556 *	@walk: list head on pernet policy list
 557 *	@polq: queue to hold packets while aqcuire operaion in progress
 558 *	@bydst_reinsert: policy tree node needs to be merged
 559 *	@type: XFRM_POLICY_TYPE_MAIN or _SUB
 560 *	@action: XFRM_POLICY_ALLOW or _BLOCK
 561 *	@flags: XFRM_POLICY_LOCALOK, XFRM_POLICY_ICMP
 562 *	@xfrm_nr: number of used templates in @xfrm_vec
 563 *	@family: protocol family
 564 *	@security: SELinux security label
 565 *	@xfrm_vec: array of templates to resolve state
 566 *	@rcu: rcu head, used to defer memory release
 567 *	@xdo: hardware offload state
 568 */
 569struct xfrm_policy {
 570	possible_net_t		xp_net;
 
 
 571	struct hlist_node	bydst;
 572	struct hlist_node	byidx;
 573
 574	struct hlist_head	state_cache_list;
 575
 576	/* This lock only affects elements except for entry. */
 577	rwlock_t		lock;
 578	refcount_t		refcnt;
 579	u32			pos;
 580	struct timer_list	timer;
 581
 
 582	atomic_t		genid;
 583	u32			priority;
 584	u32			index;
 585	u32			if_id;
 586	struct xfrm_mark	mark;
 587	struct xfrm_selector	selector;
 588	struct xfrm_lifetime_cfg lft;
 589	struct xfrm_lifetime_cur curlft;
 590	struct xfrm_policy_walk_entry walk;
 591	struct xfrm_policy_queue polq;
 592	bool                    bydst_reinsert;
 593	u8			type;
 594	u8			action;
 595	u8			flags;
 596	u8			xfrm_nr;
 597	u16			family;
 598	struct xfrm_sec_ctx	*security;
 599	struct xfrm_tmpl       	xfrm_vec[XFRM_MAX_DEPTH];
 600	struct rcu_head		rcu;
 601
 602	struct xfrm_dev_offload xdo;
 603};
 604
 605static inline struct net *xp_net(const struct xfrm_policy *xp)
 606{
 607	return read_pnet(&xp->xp_net);
 608}
 609
 610struct xfrm_kmaddress {
 611	xfrm_address_t          local;
 612	xfrm_address_t          remote;
 613	u32			reserved;
 614	u16			family;
 615};
 616
 617struct xfrm_migrate {
 618	xfrm_address_t		old_daddr;
 619	xfrm_address_t		old_saddr;
 620	xfrm_address_t		new_daddr;
 621	xfrm_address_t		new_saddr;
 622	u8			proto;
 623	u8			mode;
 624	u16			reserved;
 625	u32			reqid;
 626	u16			old_family;
 627	u16			new_family;
 628};
 629
 630#define XFRM_KM_TIMEOUT                30
 
 
 
 
 631/* what happened */
 632#define XFRM_REPLAY_UPDATE	XFRM_AE_CR
 633#define XFRM_REPLAY_TIMEOUT	XFRM_AE_CE
 634
 635/* default aevent timeout in units of 100ms */
 636#define XFRM_AE_ETIME			10
 637/* Async Event timer multiplier */
 638#define XFRM_AE_ETH_M			10
 639/* default seq threshold size */
 640#define XFRM_AE_SEQT_SIZE		2
 641
 642struct xfrm_mgr {
 643	struct list_head	list;
 
 644	int			(*notify)(struct xfrm_state *x, const struct km_event *c);
 645	int			(*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp);
 646	struct xfrm_policy	*(*compile_policy)(struct sock *sk, int opt, u8 *data, int len, int *dir);
 647	int			(*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
 648	int			(*notify_policy)(struct xfrm_policy *x, int dir, const struct km_event *c);
 649	int			(*report)(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr);
 650	int			(*migrate)(const struct xfrm_selector *sel,
 651					   u8 dir, u8 type,
 652					   const struct xfrm_migrate *m,
 653					   int num_bundles,
 654					   const struct xfrm_kmaddress *k,
 655					   const struct xfrm_encap_tmpl *encap);
 656	bool			(*is_alive)(const struct km_event *c);
 657};
 658
 659void xfrm_register_km(struct xfrm_mgr *km);
 660void xfrm_unregister_km(struct xfrm_mgr *km);
 661
 662struct xfrm_tunnel_skb_cb {
 663	union {
 664		struct inet_skb_parm h4;
 665		struct inet6_skb_parm h6;
 666	} header;
 667
 668	union {
 669		struct ip_tunnel *ip4;
 670		struct ip6_tnl *ip6;
 671	} tunnel;
 672};
 673
 674#define XFRM_TUNNEL_SKB_CB(__skb) ((struct xfrm_tunnel_skb_cb *)&((__skb)->cb[0]))
 675
 676/*
 677 * This structure is used for the duration where packets are being
 678 * transformed by IPsec.  As soon as the packet leaves IPsec the
 679 * area beyond the generic IP part may be overwritten.
 680 */
 681struct xfrm_skb_cb {
 682	struct xfrm_tunnel_skb_cb header;
 
 
 
 683
 684        /* Sequence number for replay protection. */
 685	union {
 686		struct {
 687			__u32 low;
 688			__u32 hi;
 689		} output;
 690		struct {
 691			__be32 low;
 692			__be32 hi;
 693		} input;
 694	} seq;
 695};
 696
 697#define XFRM_SKB_CB(__skb) ((struct xfrm_skb_cb *)&((__skb)->cb[0]))
 698
 699/*
 700 * This structure is used by the afinfo prepare_input/prepare_output functions
 701 * to transmit header information to the mode input/output functions.
 702 */
 703struct xfrm_mode_skb_cb {
 704	struct xfrm_tunnel_skb_cb header;
 
 
 
 705
 706	/* Copied from header for IPv4, always set to zero and DF for IPv6. */
 707	__be16 id;
 708	__be16 frag_off;
 709
 710	/* IP header length (excluding options or extension headers). */
 711	u8 ihl;
 712
 713	/* TOS for IPv4, class for IPv6. */
 714	u8 tos;
 715
 716	/* TTL for IPv4, hop limitfor IPv6. */
 717	u8 ttl;
 718
 719	/* Protocol for IPv4, NH for IPv6. */
 720	u8 protocol;
 721
 722	/* Option length for IPv4, zero for IPv6. */
 723	u8 optlen;
 724
 725	/* Used by IPv6 only, zero for IPv4. */
 726	u8 flow_lbl[3];
 727};
 728
 729#define XFRM_MODE_SKB_CB(__skb) ((struct xfrm_mode_skb_cb *)&((__skb)->cb[0]))
 730
 731/*
 732 * This structure is used by the input processing to locate the SPI and
 733 * related information.
 734 */
 735struct xfrm_spi_skb_cb {
 736	struct xfrm_tunnel_skb_cb header;
 
 
 
 737
 738	unsigned int daddroff;
 739	unsigned int family;
 740	__be32 seq;
 741};
 742
 743#define XFRM_SPI_SKB_CB(__skb) ((struct xfrm_spi_skb_cb *)&((__skb)->cb[0]))
 744
 
 
 
 
 
 
 
 745#ifdef CONFIG_AUDITSYSCALL
 746static inline struct audit_buffer *xfrm_audit_start(const char *op)
 747{
 748	struct audit_buffer *audit_buf = NULL;
 749
 750	if (audit_enabled == AUDIT_OFF)
 751		return NULL;
 752	audit_buf = audit_log_start(audit_context(), GFP_ATOMIC,
 753				    AUDIT_MAC_IPSEC_EVENT);
 754	if (audit_buf == NULL)
 755		return NULL;
 756	audit_log_format(audit_buf, "op=%s", op);
 757	return audit_buf;
 758}
 759
 760static inline void xfrm_audit_helper_usrinfo(bool task_valid,
 761					     struct audit_buffer *audit_buf)
 762{
 763	const unsigned int auid = from_kuid(&init_user_ns, task_valid ?
 764					    audit_get_loginuid(current) :
 765					    INVALID_UID);
 766	const unsigned int ses = task_valid ? audit_get_sessionid(current) :
 767		AUDIT_SID_UNSET;
 768
 769	audit_log_format(audit_buf, " auid=%u ses=%u", auid, ses);
 770	audit_log_task_context(audit_buf);
 771}
 772
 773void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, bool task_valid);
 774void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
 775			      bool task_valid);
 776void xfrm_audit_state_add(struct xfrm_state *x, int result, bool task_valid);
 777void xfrm_audit_state_delete(struct xfrm_state *x, int result, bool task_valid);
 778void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
 779				      struct sk_buff *skb);
 780void xfrm_audit_state_replay(struct xfrm_state *x, struct sk_buff *skb,
 781			     __be32 net_seq);
 782void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family);
 783void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, __be32 net_spi,
 784			       __be32 net_seq);
 785void xfrm_audit_state_icvfail(struct xfrm_state *x, struct sk_buff *skb,
 786			      u8 proto);
 
 
 
 
 
 
 
 
 787#else
 788
 789static inline void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
 790					 bool task_valid)
 791{
 792}
 793
 794static inline void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
 795					    bool task_valid)
 796{
 797}
 798
 799static inline void xfrm_audit_state_add(struct xfrm_state *x, int result,
 800					bool task_valid)
 801{
 802}
 803
 804static inline void xfrm_audit_state_delete(struct xfrm_state *x, int result,
 805					   bool task_valid)
 806{
 807}
 808
 809static inline void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
 810					     struct sk_buff *skb)
 811{
 812}
 813
 814static inline void xfrm_audit_state_replay(struct xfrm_state *x,
 815					   struct sk_buff *skb, __be32 net_seq)
 816{
 817}
 818
 819static inline void xfrm_audit_state_notfound_simple(struct sk_buff *skb,
 820				      u16 family)
 821{
 822}
 823
 824static inline void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
 825				      __be32 net_spi, __be32 net_seq)
 826{
 827}
 828
 829static inline void xfrm_audit_state_icvfail(struct xfrm_state *x,
 830				     struct sk_buff *skb, u8 proto)
 831{
 832}
 833#endif /* CONFIG_AUDITSYSCALL */
 834
 835static inline void xfrm_pol_hold(struct xfrm_policy *policy)
 836{
 837	if (likely(policy != NULL))
 838		refcount_inc(&policy->refcnt);
 839}
 840
 841void xfrm_policy_destroy(struct xfrm_policy *policy);
 842
 843static inline void xfrm_pol_put(struct xfrm_policy *policy)
 844{
 845	if (refcount_dec_and_test(&policy->refcnt))
 846		xfrm_policy_destroy(policy);
 847}
 848
 849static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols)
 850{
 851	int i;
 852	for (i = npols - 1; i >= 0; --i)
 853		xfrm_pol_put(pols[i]);
 854}
 855
 856void __xfrm_state_destroy(struct xfrm_state *, bool);
 857
 858static inline void __xfrm_state_put(struct xfrm_state *x)
 859{
 860	refcount_dec(&x->refcnt);
 861}
 862
 863static inline void xfrm_state_put(struct xfrm_state *x)
 864{
 865	if (refcount_dec_and_test(&x->refcnt))
 866		__xfrm_state_destroy(x, false);
 867}
 868
 869static inline void xfrm_state_put_sync(struct xfrm_state *x)
 870{
 871	if (refcount_dec_and_test(&x->refcnt))
 872		__xfrm_state_destroy(x, true);
 873}
 874
 875static inline void xfrm_state_hold(struct xfrm_state *x)
 876{
 877	refcount_inc(&x->refcnt);
 878}
 879
 880static inline bool addr_match(const void *token1, const void *token2,
 881			      unsigned int prefixlen)
 882{
 883	const __be32 *a1 = token1;
 884	const __be32 *a2 = token2;
 885	unsigned int pdw;
 886	unsigned int pbi;
 887
 888	pdw = prefixlen >> 5;	  /* num of whole u32 in prefix */
 889	pbi = prefixlen &  0x1f;  /* num of bits in incomplete u32 in prefix */
 890
 891	if (pdw)
 892		if (memcmp(a1, a2, pdw << 2))
 893			return false;
 894
 895	if (pbi) {
 896		__be32 mask;
 897
 898		mask = htonl((0xffffffff) << (32 - pbi));
 899
 900		if ((a1[pdw] ^ a2[pdw]) & mask)
 901			return false;
 902	}
 903
 904	return true;
 905}
 906
 907static inline bool addr4_match(__be32 a1, __be32 a2, u8 prefixlen)
 908{
 909	/* C99 6.5.7 (3): u32 << 32 is undefined behaviour */
 910	if (sizeof(long) == 4 && prefixlen == 0)
 911		return true;
 912	return !((a1 ^ a2) & htonl(~0UL << (32 - prefixlen)));
 913}
 914
 915static __inline__
 916__be16 xfrm_flowi_sport(const struct flowi *fl, const union flowi_uli *uli)
 917{
 918	__be16 port;
 919	switch(fl->flowi_proto) {
 920	case IPPROTO_TCP:
 921	case IPPROTO_UDP:
 922	case IPPROTO_UDPLITE:
 923	case IPPROTO_SCTP:
 924		port = uli->ports.sport;
 925		break;
 926	case IPPROTO_ICMP:
 927	case IPPROTO_ICMPV6:
 928		port = htons(uli->icmpt.type);
 929		break;
 930	case IPPROTO_MH:
 931		port = htons(uli->mht.type);
 932		break;
 933	case IPPROTO_GRE:
 934		port = htons(ntohl(uli->gre_key) >> 16);
 935		break;
 936	default:
 937		port = 0;	/*XXX*/
 938	}
 939	return port;
 940}
 941
 942static __inline__
 943__be16 xfrm_flowi_dport(const struct flowi *fl, const union flowi_uli *uli)
 944{
 945	__be16 port;
 946	switch(fl->flowi_proto) {
 947	case IPPROTO_TCP:
 948	case IPPROTO_UDP:
 949	case IPPROTO_UDPLITE:
 950	case IPPROTO_SCTP:
 951		port = uli->ports.dport;
 952		break;
 953	case IPPROTO_ICMP:
 954	case IPPROTO_ICMPV6:
 955		port = htons(uli->icmpt.code);
 956		break;
 957	case IPPROTO_GRE:
 958		port = htons(ntohl(uli->gre_key) & 0xffff);
 959		break;
 960	default:
 961		port = 0;	/*XXX*/
 962	}
 963	return port;
 964}
 965
 966bool xfrm_selector_match(const struct xfrm_selector *sel,
 967			 const struct flowi *fl, unsigned short family);
 
 968
 969#ifdef CONFIG_SECURITY_NETWORK_XFRM
 970/*	If neither has a context --> match
 971 * 	Otherwise, both must have a context and the sids, doi, alg must match
 972 */
 973static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
 974{
 975	return ((!s1 && !s2) ||
 976		(s1 && s2 &&
 977		 (s1->ctx_sid == s2->ctx_sid) &&
 978		 (s1->ctx_doi == s2->ctx_doi) &&
 979		 (s1->ctx_alg == s2->ctx_alg)));
 980}
 981#else
 982static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
 983{
 984	return true;
 985}
 986#endif
 987
 988/* A struct encoding bundle of transformations to apply to some set of flow.
 989 *
 990 * xdst->child points to the next element of bundle.
 991 * dst->xfrm  points to an instanse of transformer.
 992 *
 993 * Due to unfortunate limitations of current routing cache, which we
 994 * have no time to fix, it mirrors struct rtable and bound to the same
 995 * routing key, including saddr,daddr. However, we can have many of
 996 * bundles differing by session id. All the bundles grow from a parent
 997 * policy rule.
 998 */
 999struct xfrm_dst {
1000	union {
1001		struct dst_entry	dst;
1002		struct rtable		rt;
1003		struct rt6_info		rt6;
1004	} u;
1005	struct dst_entry *route;
1006	struct dst_entry *child;
1007	struct dst_entry *path;
1008	struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX];
1009	int num_pols, num_xfrms;
 
 
 
 
1010	u32 xfrm_genid;
1011	u32 policy_genid;
1012	u32 route_mtu_cached;
1013	u32 child_mtu_cached;
1014	u32 route_cookie;
1015	u32 path_cookie;
1016};
1017
1018static inline struct dst_entry *xfrm_dst_path(const struct dst_entry *dst)
1019{
1020#ifdef CONFIG_XFRM
1021	if (dst->xfrm || (dst->flags & DST_XFRM_QUEUE)) {
1022		const struct xfrm_dst *xdst = (const struct xfrm_dst *) dst;
1023
1024		return xdst->path;
1025	}
1026#endif
1027	return (struct dst_entry *) dst;
1028}
1029
1030static inline struct dst_entry *xfrm_dst_child(const struct dst_entry *dst)
1031{
1032#ifdef CONFIG_XFRM
1033	if (dst->xfrm || (dst->flags & DST_XFRM_QUEUE)) {
1034		struct xfrm_dst *xdst = (struct xfrm_dst *) dst;
1035		return xdst->child;
1036	}
1037#endif
1038	return NULL;
1039}
1040
1041#ifdef CONFIG_XFRM
1042static inline void xfrm_dst_set_child(struct xfrm_dst *xdst, struct dst_entry *child)
1043{
1044	xdst->child = child;
1045}
1046
1047static inline void xfrm_dst_destroy(struct xfrm_dst *xdst)
1048{
1049	xfrm_pols_put(xdst->pols, xdst->num_pols);
1050	dst_release(xdst->route);
1051	if (likely(xdst->u.dst.xfrm))
1052		xfrm_state_put(xdst->u.dst.xfrm);
 
 
 
 
 
 
1053}
1054#endif
1055
1056void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev);
1057
1058struct xfrm_if_parms {
1059	int link;		/* ifindex of underlying L2 interface */
1060	u32 if_id;		/* interface identifier */
1061	bool collect_md;
1062};
1063
1064struct xfrm_if {
1065	struct xfrm_if __rcu *next;	/* next interface in list */
1066	struct net_device *dev;		/* virtual device associated with interface */
1067	struct net *net;		/* netns for packet i/o */
1068	struct xfrm_if_parms p;		/* interface parms */
1069
1070	struct gro_cells gro_cells;
 
 
 
1071};
1072
1073struct xfrm_offload {
1074	/* Output sequence number for replay protection on offloading. */
1075	struct {
1076		__u32 low;
1077		__u32 hi;
1078	} seq;
1079
1080	__u32			flags;
1081#define	SA_DELETE_REQ		1
1082#define	CRYPTO_DONE		2
1083#define	CRYPTO_NEXT_DONE	4
1084#define	CRYPTO_FALLBACK		8
1085#define	XFRM_GSO_SEGMENT	16
1086#define	XFRM_GRO		32
1087/* 64 is free */
1088#define	XFRM_DEV_RESUME		128
1089#define	XFRM_XMIT		256
1090
1091	__u32			status;
1092#define CRYPTO_SUCCESS				1
1093#define CRYPTO_GENERIC_ERROR			2
1094#define CRYPTO_TRANSPORT_AH_AUTH_FAILED		4
1095#define CRYPTO_TRANSPORT_ESP_AUTH_FAILED	8
1096#define CRYPTO_TUNNEL_AH_AUTH_FAILED		16
1097#define CRYPTO_TUNNEL_ESP_AUTH_FAILED		32
1098#define CRYPTO_INVALID_PACKET_SYNTAX		64
1099#define CRYPTO_INVALID_PROTOCOL			128
1100
1101	/* Used to keep whole l2 header for transport mode GRO */
1102	__u32			orig_mac_len;
 
 
 
 
 
1103
1104	__u8			proto;
1105	__u8			inner_ipproto;
1106};
1107
1108struct sec_path {
1109	int			len;
1110	int			olen;
1111	int			verified_cnt;
1112
1113	struct xfrm_state	*xvec[XFRM_MAX_DEPTH];
1114	struct xfrm_offload	ovec[XFRM_MAX_OFFLOAD_DEPTH];
1115};
1116
1117struct sec_path *secpath_set(struct sk_buff *skb);
1118
1119static inline void
1120secpath_reset(struct sk_buff *skb)
1121{
1122#ifdef CONFIG_XFRM
1123	skb_ext_del(skb, SKB_EXT_SEC_PATH);
 
1124#endif
1125}
1126
1127static inline int
1128xfrm_addr_any(const xfrm_address_t *addr, unsigned short family)
1129{
1130	switch (family) {
1131	case AF_INET:
1132		return addr->a4 == 0;
1133	case AF_INET6:
1134		return ipv6_addr_any(&addr->in6);
1135	}
1136	return 0;
1137}
1138
1139static inline int
1140__xfrm4_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x)
1141{
1142	return	(tmpl->saddr.a4 &&
1143		 tmpl->saddr.a4 != x->props.saddr.a4);
1144}
1145
1146static inline int
1147__xfrm6_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x)
1148{
1149	return	(!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) &&
1150		 !ipv6_addr_equal((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr));
1151}
1152
1153static inline int
1154xfrm_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x, unsigned short family)
1155{
1156	switch (family) {
1157	case AF_INET:
1158		return __xfrm4_state_addr_cmp(tmpl, x);
1159	case AF_INET6:
1160		return __xfrm6_state_addr_cmp(tmpl, x);
1161	}
1162	return !0;
1163}
1164
1165#ifdef CONFIG_XFRM
1166static inline struct xfrm_state *xfrm_input_state(struct sk_buff *skb)
1167{
1168	struct sec_path *sp = skb_sec_path(skb);
1169
1170	return sp->xvec[sp->len - 1];
1171}
1172#endif
1173
1174static inline struct xfrm_offload *xfrm_offload(struct sk_buff *skb)
1175{
1176#ifdef CONFIG_XFRM
1177	struct sec_path *sp = skb_sec_path(skb);
1178
1179	if (!sp || !sp->olen || sp->len != sp->olen)
1180		return NULL;
1181
1182	return &sp->ovec[sp->olen - 1];
1183#else
1184	return NULL;
1185#endif
1186}
1187
1188#ifdef CONFIG_XFRM
1189int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb,
1190			unsigned short family);
1191
1192static inline bool __xfrm_check_nopolicy(struct net *net, struct sk_buff *skb,
1193					 int dir)
1194{
1195	if (!net->xfrm.policy_count[dir] && !secpath_exists(skb))
1196		return net->xfrm.policy_default[dir] == XFRM_USERPOLICY_ACCEPT;
1197
1198	return false;
1199}
1200
1201static inline bool __xfrm_check_dev_nopolicy(struct sk_buff *skb,
1202					     int dir, unsigned short family)
1203{
1204	if (dir != XFRM_POLICY_OUT && family == AF_INET) {
1205		/* same dst may be used for traffic originating from
1206		 * devices with different policy settings.
1207		 */
1208		return IPCB(skb)->flags & IPSKB_NOPOLICY;
1209	}
1210	return skb_dst(skb) && (skb_dst(skb)->flags & DST_NOPOLICY);
1211}
1212
1213static inline int __xfrm_policy_check2(struct sock *sk, int dir,
1214				       struct sk_buff *skb,
1215				       unsigned int family, int reverse)
1216{
1217	struct net *net = dev_net(skb->dev);
1218	int ndir = dir | (reverse ? XFRM_POLICY_MASK + 1 : 0);
1219	struct xfrm_offload *xo = xfrm_offload(skb);
1220	struct xfrm_state *x;
1221
1222	if (sk && sk->sk_policy[XFRM_POLICY_IN])
1223		return __xfrm_policy_check(sk, ndir, skb, family);
1224
1225	if (xo) {
1226		x = xfrm_input_state(skb);
1227		if (x->xso.type == XFRM_DEV_OFFLOAD_PACKET) {
1228			bool check = (xo->flags & CRYPTO_DONE) &&
1229				     (xo->status & CRYPTO_SUCCESS);
1230
1231			/* The packets here are plain ones and secpath was
1232			 * needed to indicate that hardware already handled
1233			 * them and there is no need to do nothing in addition.
1234			 *
1235			 * Consume secpath which was set by drivers.
1236			 */
1237			secpath_reset(skb);
1238			return check;
1239		}
1240	}
1241
1242	return __xfrm_check_nopolicy(net, skb, dir) ||
1243	       __xfrm_check_dev_nopolicy(skb, dir, family) ||
1244	       __xfrm_policy_check(sk, ndir, skb, family);
1245}
1246
1247static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
1248{
1249	return __xfrm_policy_check2(sk, dir, skb, family, 0);
1250}
1251
1252static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1253{
1254	return xfrm_policy_check(sk, dir, skb, AF_INET);
1255}
1256
1257static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1258{
1259	return xfrm_policy_check(sk, dir, skb, AF_INET6);
1260}
1261
1262static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
1263					     struct sk_buff *skb)
1264{
1265	return __xfrm_policy_check2(sk, dir, skb, AF_INET, 1);
1266}
1267
1268static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
1269					     struct sk_buff *skb)
1270{
1271	return __xfrm_policy_check2(sk, dir, skb, AF_INET6, 1);
1272}
1273
1274int __xfrm_decode_session(struct net *net, struct sk_buff *skb, struct flowi *fl,
1275			  unsigned int family, int reverse);
1276
1277static inline int xfrm_decode_session(struct net *net, struct sk_buff *skb, struct flowi *fl,
1278				      unsigned int family)
1279{
1280	return __xfrm_decode_session(net, skb, fl, family, 0);
1281}
1282
1283static inline int xfrm_decode_session_reverse(struct net *net, struct sk_buff *skb,
1284					      struct flowi *fl,
1285					      unsigned int family)
1286{
1287	return __xfrm_decode_session(net, skb, fl, family, 1);
1288}
1289
1290int __xfrm_route_forward(struct sk_buff *skb, unsigned short family);
1291
1292static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family)
1293{
1294	struct net *net = dev_net(skb->dev);
1295
1296	if (!net->xfrm.policy_count[XFRM_POLICY_OUT] &&
1297	    net->xfrm.policy_default[XFRM_POLICY_OUT] == XFRM_USERPOLICY_ACCEPT)
1298		return true;
1299
1300	return (skb_dst(skb)->flags & DST_NOXFRM) ||
1301	       __xfrm_route_forward(skb, family);
1302}
1303
1304static inline int xfrm4_route_forward(struct sk_buff *skb)
1305{
1306	return xfrm_route_forward(skb, AF_INET);
1307}
1308
1309static inline int xfrm6_route_forward(struct sk_buff *skb)
1310{
1311	return xfrm_route_forward(skb, AF_INET6);
1312}
1313
1314int __xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk);
1315
1316static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk)
1317{
1318	if (!sk_fullsock(osk))
1319		return 0;
1320	sk->sk_policy[0] = NULL;
1321	sk->sk_policy[1] = NULL;
1322	if (unlikely(osk->sk_policy[0] || osk->sk_policy[1]))
1323		return __xfrm_sk_clone_policy(sk, osk);
1324	return 0;
1325}
1326
1327int xfrm_policy_delete(struct xfrm_policy *pol, int dir);
1328
1329static inline void xfrm_sk_free_policy(struct sock *sk)
1330{
1331	struct xfrm_policy *pol;
1332
1333	pol = rcu_dereference_protected(sk->sk_policy[0], 1);
1334	if (unlikely(pol != NULL)) {
1335		xfrm_policy_delete(pol, XFRM_POLICY_MAX);
1336		sk->sk_policy[0] = NULL;
1337	}
1338	pol = rcu_dereference_protected(sk->sk_policy[1], 1);
1339	if (unlikely(pol != NULL)) {
1340		xfrm_policy_delete(pol, XFRM_POLICY_MAX+1);
1341		sk->sk_policy[1] = NULL;
1342	}
1343}
1344
1345#else
1346
1347static inline void xfrm_sk_free_policy(struct sock *sk) {}
1348static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk) { return 0; }
1349static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; }
1350static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; }
1351static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1352{
1353	return 1;
1354}
1355static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1356{
1357	return 1;
1358}
1359static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
1360{
1361	return 1;
1362}
1363static inline int xfrm_decode_session_reverse(struct net *net, struct sk_buff *skb,
1364					      struct flowi *fl,
1365					      unsigned int family)
1366{
1367	return -ENOSYS;
1368}
1369static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
1370					     struct sk_buff *skb)
1371{
1372	return 1;
1373}
1374static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
1375					     struct sk_buff *skb)
1376{
1377	return 1;
1378}
1379#endif
1380
1381static __inline__
1382xfrm_address_t *xfrm_flowi_daddr(const struct flowi *fl, unsigned short family)
1383{
1384	switch (family){
1385	case AF_INET:
1386		return (xfrm_address_t *)&fl->u.ip4.daddr;
1387	case AF_INET6:
1388		return (xfrm_address_t *)&fl->u.ip6.daddr;
1389	}
1390	return NULL;
1391}
1392
1393static __inline__
1394xfrm_address_t *xfrm_flowi_saddr(const struct flowi *fl, unsigned short family)
1395{
1396	switch (family){
1397	case AF_INET:
1398		return (xfrm_address_t *)&fl->u.ip4.saddr;
1399	case AF_INET6:
1400		return (xfrm_address_t *)&fl->u.ip6.saddr;
1401	}
1402	return NULL;
1403}
1404
1405static __inline__
1406void xfrm_flowi_addr_get(const struct flowi *fl,
1407			 xfrm_address_t *saddr, xfrm_address_t *daddr,
1408			 unsigned short family)
1409{
1410	switch(family) {
1411	case AF_INET:
1412		memcpy(&saddr->a4, &fl->u.ip4.saddr, sizeof(saddr->a4));
1413		memcpy(&daddr->a4, &fl->u.ip4.daddr, sizeof(daddr->a4));
1414		break;
1415	case AF_INET6:
1416		saddr->in6 = fl->u.ip6.saddr;
1417		daddr->in6 = fl->u.ip6.daddr;
1418		break;
1419	}
1420}
1421
1422static __inline__ int
1423__xfrm4_state_addr_check(const struct xfrm_state *x,
1424			 const xfrm_address_t *daddr, const xfrm_address_t *saddr)
1425{
1426	if (daddr->a4 == x->id.daddr.a4 &&
1427	    (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4))
1428		return 1;
1429	return 0;
1430}
1431
1432static __inline__ int
1433__xfrm6_state_addr_check(const struct xfrm_state *x,
1434			 const xfrm_address_t *daddr, const xfrm_address_t *saddr)
1435{
1436	if (ipv6_addr_equal((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) &&
1437	    (ipv6_addr_equal((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr) ||
1438	     ipv6_addr_any((struct in6_addr *)saddr) ||
1439	     ipv6_addr_any((struct in6_addr *)&x->props.saddr)))
1440		return 1;
1441	return 0;
1442}
1443
1444static __inline__ int
1445xfrm_state_addr_check(const struct xfrm_state *x,
1446		      const xfrm_address_t *daddr, const xfrm_address_t *saddr,
1447		      unsigned short family)
1448{
1449	switch (family) {
1450	case AF_INET:
1451		return __xfrm4_state_addr_check(x, daddr, saddr);
1452	case AF_INET6:
1453		return __xfrm6_state_addr_check(x, daddr, saddr);
1454	}
1455	return 0;
1456}
1457
1458static __inline__ int
1459xfrm_state_addr_flow_check(const struct xfrm_state *x, const struct flowi *fl,
1460			   unsigned short family)
1461{
1462	switch (family) {
1463	case AF_INET:
1464		return __xfrm4_state_addr_check(x,
1465						(const xfrm_address_t *)&fl->u.ip4.daddr,
1466						(const xfrm_address_t *)&fl->u.ip4.saddr);
1467	case AF_INET6:
1468		return __xfrm6_state_addr_check(x,
1469						(const xfrm_address_t *)&fl->u.ip6.daddr,
1470						(const xfrm_address_t *)&fl->u.ip6.saddr);
1471	}
1472	return 0;
1473}
1474
1475static inline int xfrm_state_kern(const struct xfrm_state *x)
1476{
1477	return atomic_read(&x->tunnel_users);
1478}
1479
1480static inline bool xfrm_id_proto_valid(u8 proto)
1481{
1482	switch (proto) {
1483	case IPPROTO_AH:
1484	case IPPROTO_ESP:
1485	case IPPROTO_COMP:
1486#if IS_ENABLED(CONFIG_IPV6)
1487	case IPPROTO_ROUTING:
1488	case IPPROTO_DSTOPTS:
1489#endif
1490		return true;
1491	default:
1492		return false;
1493	}
1494}
1495
1496/* IPSEC_PROTO_ANY only matches 3 IPsec protocols, 0 could match all. */
1497static inline int xfrm_id_proto_match(u8 proto, u8 userproto)
1498{
1499	return (!userproto || proto == userproto ||
1500		(userproto == IPSEC_PROTO_ANY && (proto == IPPROTO_AH ||
1501						  proto == IPPROTO_ESP ||
1502						  proto == IPPROTO_COMP)));
1503}
1504
1505/*
1506 * xfrm algorithm information
1507 */
1508struct xfrm_algo_aead_info {
1509	char *geniv;
1510	u16 icv_truncbits;
1511};
1512
1513struct xfrm_algo_auth_info {
1514	u16 icv_truncbits;
1515	u16 icv_fullbits;
1516};
1517
1518struct xfrm_algo_encr_info {
1519	char *geniv;
1520	u16 blockbits;
1521	u16 defkeybits;
1522};
1523
1524struct xfrm_algo_comp_info {
1525	u16 threshold;
1526};
1527
1528struct xfrm_algo_desc {
1529	char *name;
1530	char *compat;
1531	u8 available:1;
1532	u8 pfkey_supported:1;
1533	union {
1534		struct xfrm_algo_aead_info aead;
1535		struct xfrm_algo_auth_info auth;
1536		struct xfrm_algo_encr_info encr;
1537		struct xfrm_algo_comp_info comp;
1538	} uinfo;
1539	struct sadb_alg desc;
1540};
1541
1542/* XFRM protocol handlers.  */
1543struct xfrm4_protocol {
1544	int (*handler)(struct sk_buff *skb);
1545	int (*input_handler)(struct sk_buff *skb, int nexthdr, __be32 spi,
1546			     int encap_type);
1547	int (*cb_handler)(struct sk_buff *skb, int err);
1548	int (*err_handler)(struct sk_buff *skb, u32 info);
1549
1550	struct xfrm4_protocol __rcu *next;
1551	int priority;
1552};
1553
1554struct xfrm6_protocol {
1555	int (*handler)(struct sk_buff *skb);
1556	int (*input_handler)(struct sk_buff *skb, int nexthdr, __be32 spi,
1557			     int encap_type);
1558	int (*cb_handler)(struct sk_buff *skb, int err);
1559	int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
1560			   u8 type, u8 code, int offset, __be32 info);
1561
1562	struct xfrm6_protocol __rcu *next;
1563	int priority;
1564};
1565
1566/* XFRM tunnel handlers.  */
1567struct xfrm_tunnel {
1568	int (*handler)(struct sk_buff *skb);
1569	int (*cb_handler)(struct sk_buff *skb, int err);
1570	int (*err_handler)(struct sk_buff *skb, u32 info);
1571
1572	struct xfrm_tunnel __rcu *next;
1573	int priority;
1574};
1575
1576struct xfrm6_tunnel {
1577	int (*handler)(struct sk_buff *skb);
1578	int (*cb_handler)(struct sk_buff *skb, int err);
1579	int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
1580			   u8 type, u8 code, int offset, __be32 info);
1581	struct xfrm6_tunnel __rcu *next;
1582	int priority;
1583};
1584
1585void xfrm_init(void);
1586void xfrm4_init(void);
1587int xfrm_state_init(struct net *net);
1588void xfrm_state_fini(struct net *net);
1589void xfrm4_state_init(void);
1590void xfrm4_protocol_init(void);
1591#ifdef CONFIG_XFRM
1592int xfrm6_init(void);
1593void xfrm6_fini(void);
1594int xfrm6_state_init(void);
1595void xfrm6_state_fini(void);
1596int xfrm6_protocol_init(void);
1597void xfrm6_protocol_fini(void);
1598#else
1599static inline int xfrm6_init(void)
1600{
1601	return 0;
1602}
1603static inline void xfrm6_fini(void)
1604{
1605	;
1606}
1607#endif
1608
1609#ifdef CONFIG_XFRM_STATISTICS
1610int xfrm_proc_init(struct net *net);
1611void xfrm_proc_fini(struct net *net);
1612#endif
1613
1614int xfrm_sysctl_init(struct net *net);
1615#ifdef CONFIG_SYSCTL
1616void xfrm_sysctl_fini(struct net *net);
1617#else
1618static inline void xfrm_sysctl_fini(struct net *net)
1619{
1620}
1621#endif
1622
1623void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto,
1624			  struct xfrm_address_filter *filter);
1625int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk,
1626		    int (*func)(struct xfrm_state *, int, void*), void *);
1627void xfrm_state_walk_done(struct xfrm_state_walk *walk, struct net *net);
1628struct xfrm_state *xfrm_state_alloc(struct net *net);
1629void xfrm_state_free(struct xfrm_state *x);
1630struct xfrm_state *xfrm_state_find(const xfrm_address_t *daddr,
1631				   const xfrm_address_t *saddr,
1632				   const struct flowi *fl,
1633				   struct xfrm_tmpl *tmpl,
1634				   struct xfrm_policy *pol, int *err,
1635				   unsigned short family, u32 if_id);
1636struct xfrm_state *xfrm_stateonly_find(struct net *net, u32 mark, u32 if_id,
1637				       xfrm_address_t *daddr,
1638				       xfrm_address_t *saddr,
1639				       unsigned short family,
1640				       u8 mode, u8 proto, u32 reqid);
1641struct xfrm_state *xfrm_state_lookup_byspi(struct net *net, __be32 spi,
1642					      unsigned short family);
1643int xfrm_state_check_expire(struct xfrm_state *x);
1644void xfrm_state_update_stats(struct net *net);
1645#ifdef CONFIG_XFRM_OFFLOAD
1646static inline void xfrm_dev_state_update_stats(struct xfrm_state *x)
1647{
1648	struct xfrm_dev_offload *xdo = &x->xso;
1649	struct net_device *dev = READ_ONCE(xdo->dev);
1650
1651	if (dev && dev->xfrmdev_ops &&
1652	    dev->xfrmdev_ops->xdo_dev_state_update_stats)
1653		dev->xfrmdev_ops->xdo_dev_state_update_stats(x);
1654
1655}
1656#else
1657static inline void xfrm_dev_state_update_stats(struct xfrm_state *x) {}
1658#endif
1659void xfrm_state_insert(struct xfrm_state *x);
1660int xfrm_state_add(struct xfrm_state *x);
1661int xfrm_state_update(struct xfrm_state *x);
1662struct xfrm_state *xfrm_state_lookup(struct net *net, u32 mark,
1663				     const xfrm_address_t *daddr, __be32 spi,
1664				     u8 proto, unsigned short family);
1665struct xfrm_state *xfrm_input_state_lookup(struct net *net, u32 mark,
1666					   const xfrm_address_t *daddr,
1667					   __be32 spi, u8 proto,
1668					   unsigned short family);
1669struct xfrm_state *xfrm_state_lookup_byaddr(struct net *net, u32 mark,
1670					    const xfrm_address_t *daddr,
1671					    const xfrm_address_t *saddr,
1672					    u8 proto,
1673					    unsigned short family);
1674#ifdef CONFIG_XFRM_SUB_POLICY
1675void xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n,
1676		    unsigned short family);
1677void xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n,
1678		     unsigned short family);
1679#else
1680static inline void xfrm_tmpl_sort(struct xfrm_tmpl **d, struct xfrm_tmpl **s,
1681				  int n, unsigned short family)
1682{
 
1683}
1684
1685static inline void xfrm_state_sort(struct xfrm_state **d, struct xfrm_state **s,
1686				   int n, unsigned short family)
1687{
 
1688}
1689#endif
1690
1691struct xfrmk_sadinfo {
1692	u32 sadhcnt; /* current hash bkts */
1693	u32 sadhmcnt; /* max allowed hash bkts */
1694	u32 sadcnt; /* current running count */
1695};
1696
1697struct xfrmk_spdinfo {
1698	u32 incnt;
1699	u32 outcnt;
1700	u32 fwdcnt;
1701	u32 inscnt;
1702	u32 outscnt;
1703	u32 fwdscnt;
1704	u32 spdhcnt;
1705	u32 spdhmcnt;
1706};
1707
1708struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq, u32 pcpu_num);
1709int xfrm_state_delete(struct xfrm_state *x);
1710int xfrm_state_flush(struct net *net, u8 proto, bool task_valid, bool sync);
1711int xfrm_dev_state_flush(struct net *net, struct net_device *dev, bool task_valid);
1712int xfrm_dev_policy_flush(struct net *net, struct net_device *dev,
1713			  bool task_valid);
1714void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si);
1715void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si);
1716u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq);
1717int xfrm_init_replay(struct xfrm_state *x, struct netlink_ext_ack *extack);
1718u32 xfrm_state_mtu(struct xfrm_state *x, int mtu);
1719int __xfrm_init_state(struct xfrm_state *x, bool init_replay, bool offload,
1720		      struct netlink_ext_ack *extack);
1721int xfrm_init_state(struct xfrm_state *x);
1722int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type);
1723int xfrm_input_resume(struct sk_buff *skb, int nexthdr);
1724int xfrm_trans_queue_net(struct net *net, struct sk_buff *skb,
1725			 int (*finish)(struct net *, struct sock *,
1726				       struct sk_buff *));
1727int xfrm_trans_queue(struct sk_buff *skb,
1728		     int (*finish)(struct net *, struct sock *,
1729				   struct sk_buff *));
1730int xfrm_output_resume(struct sock *sk, struct sk_buff *skb, int err);
1731int xfrm_output(struct sock *sk, struct sk_buff *skb);
1732
1733#if IS_ENABLED(CONFIG_NET_PKTGEN)
1734int pktgen_xfrm_outer_mode_output(struct xfrm_state *x, struct sk_buff *skb);
1735#endif
1736
1737void xfrm_local_error(struct sk_buff *skb, int mtu);
1738int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi,
1739		    int encap_type);
1740int xfrm4_transport_finish(struct sk_buff *skb, int async);
1741int xfrm4_rcv(struct sk_buff *skb);
1742
1743static inline int xfrm4_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi)
1744{
1745	XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL;
1746	XFRM_SPI_SKB_CB(skb)->family = AF_INET;
1747	XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr);
1748	return xfrm_input(skb, nexthdr, spi, 0);
1749}
1750
1751int xfrm4_output(struct net *net, struct sock *sk, struct sk_buff *skb);
1752int xfrm4_protocol_register(struct xfrm4_protocol *handler, unsigned char protocol);
1753int xfrm4_protocol_deregister(struct xfrm4_protocol *handler, unsigned char protocol);
1754int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family);
1755int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family);
1756void xfrm4_local_error(struct sk_buff *skb, u32 mtu);
1757int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi,
1758		  struct ip6_tnl *t);
1759int xfrm6_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi,
1760		    int encap_type);
1761int xfrm6_transport_finish(struct sk_buff *skb, int async);
1762int xfrm6_rcv_tnl(struct sk_buff *skb, struct ip6_tnl *t);
1763int xfrm6_rcv(struct sk_buff *skb);
1764int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
1765		     xfrm_address_t *saddr, u8 proto);
1766void xfrm6_local_error(struct sk_buff *skb, u32 mtu);
1767int xfrm6_protocol_register(struct xfrm6_protocol *handler, unsigned char protocol);
1768int xfrm6_protocol_deregister(struct xfrm6_protocol *handler, unsigned char protocol);
1769int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family);
1770int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family);
1771__be32 xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr);
1772__be32 xfrm6_tunnel_spi_lookup(struct net *net, const xfrm_address_t *saddr);
1773int xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb);
1774
1775#ifdef CONFIG_XFRM
1776void xfrm6_local_rxpmtu(struct sk_buff *skb, u32 mtu);
1777int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb);
1778int xfrm6_udp_encap_rcv(struct sock *sk, struct sk_buff *skb);
1779struct sk_buff *xfrm4_gro_udp_encap_rcv(struct sock *sk, struct list_head *head,
1780					struct sk_buff *skb);
1781struct sk_buff *xfrm6_gro_udp_encap_rcv(struct sock *sk, struct list_head *head,
1782					struct sk_buff *skb);
1783int xfrm_user_policy(struct sock *sk, int optname, sockptr_t optval,
1784		     int optlen);
1785#else
1786static inline int xfrm_user_policy(struct sock *sk, int optname,
1787				   sockptr_t optval, int optlen)
1788{
1789 	return -ENOPROTOOPT;
 
 
 
 
 
 
 
1790}
1791#endif
1792
1793struct dst_entry *__xfrm_dst_lookup(int family, const struct xfrm_dst_lookup_params *params);
1794
1795struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp);
1796
1797void xfrm_policy_walk_init(struct xfrm_policy_walk *walk, u8 type);
1798int xfrm_policy_walk(struct net *net, struct xfrm_policy_walk *walk,
1799		     int (*func)(struct xfrm_policy *, int, int, void*),
1800		     void *);
1801void xfrm_policy_walk_done(struct xfrm_policy_walk *walk, struct net *net);
1802int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl);
1803struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net,
1804					  const struct xfrm_mark *mark,
1805					  u32 if_id, u8 type, int dir,
1806					  struct xfrm_selector *sel,
1807					  struct xfrm_sec_ctx *ctx, int delete,
1808					  int *err);
1809struct xfrm_policy *xfrm_policy_byid(struct net *net,
1810				     const struct xfrm_mark *mark, u32 if_id,
1811				     u8 type, int dir, u32 id, int delete,
1812				     int *err);
1813int xfrm_policy_flush(struct net *net, u8 type, bool task_valid);
1814void xfrm_policy_hash_rebuild(struct net *net);
1815u32 xfrm_get_acqseq(void);
1816int verify_spi_info(u8 proto, u32 min, u32 max, struct netlink_ext_ack *extack);
1817int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi,
1818		   struct netlink_ext_ack *extack);
1819struct xfrm_state *xfrm_find_acq(struct net *net, const struct xfrm_mark *mark,
1820				 u8 mode, u32 reqid, u32 if_id, u32 pcpu_num, u8 proto,
1821				 const xfrm_address_t *daddr,
1822				 const xfrm_address_t *saddr, int create,
1823				 unsigned short family);
1824int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol);
1825
1826#ifdef CONFIG_XFRM_MIGRATE
1827int km_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
1828	       const struct xfrm_migrate *m, int num_bundles,
1829	       const struct xfrm_kmaddress *k,
1830	       const struct xfrm_encap_tmpl *encap);
1831struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net,
1832						u32 if_id);
1833struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x,
1834				      struct xfrm_migrate *m,
1835				      struct xfrm_encap_tmpl *encap);
1836int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
1837		 struct xfrm_migrate *m, int num_bundles,
1838		 struct xfrm_kmaddress *k, struct net *net,
1839		 struct xfrm_encap_tmpl *encap, u32 if_id,
1840		 struct netlink_ext_ack *extack);
1841#endif
1842
1843int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
1844void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 portid);
1845int km_report(struct net *net, u8 proto, struct xfrm_selector *sel,
1846	      xfrm_address_t *addr);
1847
1848void xfrm_input_init(void);
1849int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq);
1850
1851void xfrm_probe_algs(void);
1852int xfrm_count_pfkey_auth_supported(void);
1853int xfrm_count_pfkey_enc_supported(void);
1854struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx);
1855struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx);
1856struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id);
1857struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id);
1858struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id);
1859struct xfrm_algo_desc *xfrm_aalg_get_byname(const char *name, int probe);
1860struct xfrm_algo_desc *xfrm_ealg_get_byname(const char *name, int probe);
1861struct xfrm_algo_desc *xfrm_calg_get_byname(const char *name, int probe);
1862struct xfrm_algo_desc *xfrm_aead_get_byname(const char *name, int icv_len,
1863					    int probe);
1864
1865static inline bool xfrm6_addr_equal(const xfrm_address_t *a,
1866				    const xfrm_address_t *b)
1867{
1868	return ipv6_addr_equal((const struct in6_addr *)a,
1869			       (const struct in6_addr *)b);
1870}
1871
1872static inline bool xfrm_addr_equal(const xfrm_address_t *a,
1873				   const xfrm_address_t *b,
1874				   sa_family_t family)
1875{
1876	switch (family) {
1877	default:
1878	case AF_INET:
1879		return ((__force u32)a->a4 ^ (__force u32)b->a4) == 0;
1880	case AF_INET6:
1881		return xfrm6_addr_equal(a, b);
 
1882	}
1883}
1884
1885static inline int xfrm_policy_id2dir(u32 index)
1886{
1887	return index & 7;
1888}
1889
1890#ifdef CONFIG_XFRM
1891void xfrm_replay_advance(struct xfrm_state *x, __be32 net_seq);
1892int xfrm_replay_check(struct xfrm_state *x, struct sk_buff *skb, __be32 net_seq);
1893void xfrm_replay_notify(struct xfrm_state *x, int event);
1894int xfrm_replay_overflow(struct xfrm_state *x, struct sk_buff *skb);
1895int xfrm_replay_recheck(struct xfrm_state *x, struct sk_buff *skb, __be32 net_seq);
1896
1897static inline int xfrm_aevent_is_on(struct net *net)
1898{
1899	struct sock *nlsk;
1900	int ret = 0;
1901
1902	rcu_read_lock();
1903	nlsk = rcu_dereference(net->xfrm.nlsk);
1904	if (nlsk)
1905		ret = netlink_has_listeners(nlsk, XFRMNLGRP_AEVENTS);
1906	rcu_read_unlock();
1907	return ret;
1908}
1909
1910static inline int xfrm_acquire_is_on(struct net *net)
1911{
1912	struct sock *nlsk;
1913	int ret = 0;
1914
1915	rcu_read_lock();
1916	nlsk = rcu_dereference(net->xfrm.nlsk);
1917	if (nlsk)
1918		ret = netlink_has_listeners(nlsk, XFRMNLGRP_ACQUIRE);
1919	rcu_read_unlock();
1920
1921	return ret;
1922}
1923#endif
1924
1925static inline unsigned int aead_len(struct xfrm_algo_aead *alg)
1926{
1927	return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1928}
1929
1930static inline unsigned int xfrm_alg_len(const struct xfrm_algo *alg)
1931{
1932	return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1933}
1934
1935static inline unsigned int xfrm_alg_auth_len(const struct xfrm_algo_auth *alg)
1936{
1937	return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1938}
1939
1940static inline unsigned int xfrm_replay_state_esn_len(struct xfrm_replay_state_esn *replay_esn)
1941{
1942	return sizeof(*replay_esn) + replay_esn->bmp_len * sizeof(__u32);
1943}
1944
1945#ifdef CONFIG_XFRM_MIGRATE
1946static inline int xfrm_replay_clone(struct xfrm_state *x,
1947				     struct xfrm_state *orig)
1948{
1949
1950	x->replay_esn = kmemdup(orig->replay_esn,
1951				xfrm_replay_state_esn_len(orig->replay_esn),
1952				GFP_KERNEL);
1953	if (!x->replay_esn)
1954		return -ENOMEM;
1955	x->preplay_esn = kmemdup(orig->preplay_esn,
1956				 xfrm_replay_state_esn_len(orig->preplay_esn),
 
 
 
 
1957				 GFP_KERNEL);
1958	if (!x->preplay_esn)
 
1959		return -ENOMEM;
 
1960
1961	return 0;
1962}
1963
1964static inline struct xfrm_algo_aead *xfrm_algo_aead_clone(struct xfrm_algo_aead *orig)
1965{
1966	return kmemdup(orig, aead_len(orig), GFP_KERNEL);
1967}
1968
1969
1970static inline struct xfrm_algo *xfrm_algo_clone(struct xfrm_algo *orig)
1971{
1972	return kmemdup(orig, xfrm_alg_len(orig), GFP_KERNEL);
1973}
1974
1975static inline struct xfrm_algo_auth *xfrm_algo_auth_clone(struct xfrm_algo_auth *orig)
1976{
1977	return kmemdup(orig, xfrm_alg_auth_len(orig), GFP_KERNEL);
1978}
1979
1980static inline void xfrm_states_put(struct xfrm_state **states, int n)
1981{
1982	int i;
1983	for (i = 0; i < n; i++)
1984		xfrm_state_put(*(states + i));
1985}
1986
1987static inline void xfrm_states_delete(struct xfrm_state **states, int n)
1988{
1989	int i;
1990	for (i = 0; i < n; i++)
1991		xfrm_state_delete(*(states + i));
1992}
1993#endif
1994
1995void __init xfrm_dev_init(void);
1996
1997#ifdef CONFIG_XFRM_OFFLOAD
1998void xfrm_dev_resume(struct sk_buff *skb);
1999void xfrm_dev_backlog(struct softnet_data *sd);
2000struct sk_buff *validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t features, bool *again);
2001int xfrm_dev_state_add(struct net *net, struct xfrm_state *x,
2002		       struct xfrm_user_offload *xuo,
2003		       struct netlink_ext_ack *extack);
2004int xfrm_dev_policy_add(struct net *net, struct xfrm_policy *xp,
2005			struct xfrm_user_offload *xuo, u8 dir,
2006			struct netlink_ext_ack *extack);
2007bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x);
2008void xfrm_dev_state_delete(struct xfrm_state *x);
2009void xfrm_dev_state_free(struct xfrm_state *x);
2010
2011static inline void xfrm_dev_state_advance_esn(struct xfrm_state *x)
2012{
2013	struct xfrm_dev_offload *xso = &x->xso;
2014	struct net_device *dev = READ_ONCE(xso->dev);
2015
2016	if (dev && dev->xfrmdev_ops->xdo_dev_state_advance_esn)
2017		dev->xfrmdev_ops->xdo_dev_state_advance_esn(x);
2018}
2019
2020static inline bool xfrm_dst_offload_ok(struct dst_entry *dst)
2021{
2022	struct xfrm_state *x = dst->xfrm;
2023	struct xfrm_dst *xdst;
2024
2025	if (!x || !x->type_offload)
2026		return false;
2027
2028	xdst = (struct xfrm_dst *) dst;
2029	if (!x->xso.offload_handle && !xdst->child->xfrm)
2030		return true;
2031	if (x->xso.offload_handle && (x->xso.dev == xfrm_dst_path(dst)->dev) &&
2032	    !xdst->child->xfrm)
2033		return true;
2034
2035	return false;
2036}
2037
2038static inline void xfrm_dev_policy_delete(struct xfrm_policy *x)
2039{
2040	struct xfrm_dev_offload *xdo = &x->xdo;
2041	struct net_device *dev = xdo->dev;
2042
2043	if (dev && dev->xfrmdev_ops && dev->xfrmdev_ops->xdo_dev_policy_delete)
2044		dev->xfrmdev_ops->xdo_dev_policy_delete(x);
2045}
2046
2047static inline void xfrm_dev_policy_free(struct xfrm_policy *x)
2048{
2049	struct xfrm_dev_offload *xdo = &x->xdo;
2050	struct net_device *dev = xdo->dev;
2051
2052	if (dev && dev->xfrmdev_ops) {
2053		if (dev->xfrmdev_ops->xdo_dev_policy_free)
2054			dev->xfrmdev_ops->xdo_dev_policy_free(x);
2055		xdo->dev = NULL;
2056		netdev_put(dev, &xdo->dev_tracker);
2057	}
2058}
2059#else
2060static inline void xfrm_dev_resume(struct sk_buff *skb)
2061{
2062}
2063
2064static inline void xfrm_dev_backlog(struct softnet_data *sd)
2065{
2066}
2067
2068static inline struct sk_buff *validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t features, bool *again)
2069{
2070	return skb;
2071}
2072
2073static inline int xfrm_dev_state_add(struct net *net, struct xfrm_state *x, struct xfrm_user_offload *xuo, struct netlink_ext_ack *extack)
2074{
2075	return 0;
2076}
2077
2078static inline void xfrm_dev_state_delete(struct xfrm_state *x)
2079{
2080}
2081
2082static inline void xfrm_dev_state_free(struct xfrm_state *x)
2083{
2084}
2085
2086static inline int xfrm_dev_policy_add(struct net *net, struct xfrm_policy *xp,
2087				      struct xfrm_user_offload *xuo, u8 dir,
2088				      struct netlink_ext_ack *extack)
2089{
2090	return 0;
2091}
2092
2093static inline void xfrm_dev_policy_delete(struct xfrm_policy *x)
2094{
2095}
2096
2097static inline void xfrm_dev_policy_free(struct xfrm_policy *x)
2098{
2099}
2100
2101static inline bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x)
2102{
2103	return false;
2104}
2105
2106static inline void xfrm_dev_state_advance_esn(struct xfrm_state *x)
2107{
2108}
2109
2110static inline bool xfrm_dst_offload_ok(struct dst_entry *dst)
2111{
2112	return false;
2113}
2114#endif
2115
2116static inline int xfrm_mark_get(struct nlattr **attrs, struct xfrm_mark *m)
2117{
2118	if (attrs[XFRMA_MARK])
2119		memcpy(m, nla_data(attrs[XFRMA_MARK]), sizeof(struct xfrm_mark));
2120	else
2121		m->v = m->m = 0;
2122
2123	return m->v & m->m;
2124}
2125
2126static inline int xfrm_mark_put(struct sk_buff *skb, const struct xfrm_mark *m)
2127{
2128	int ret = 0;
2129
2130	if (m->m | m->v)
2131		ret = nla_put(skb, XFRMA_MARK, sizeof(struct xfrm_mark), m);
2132	return ret;
2133}
2134
2135static inline __u32 xfrm_smark_get(__u32 mark, struct xfrm_state *x)
2136{
2137	struct xfrm_mark *m = &x->props.smark;
2138
2139	return (m->v & m->m) | (mark & ~m->m);
2140}
2141
2142static inline int xfrm_if_id_put(struct sk_buff *skb, __u32 if_id)
2143{
2144	int ret = 0;
2145
2146	if (if_id)
2147		ret = nla_put_u32(skb, XFRMA_IF_ID, if_id);
2148	return ret;
2149}
2150
2151static inline int xfrm_tunnel_check(struct sk_buff *skb, struct xfrm_state *x,
2152				    unsigned int family)
2153{
2154	bool tunnel = false;
2155
2156	switch(family) {
2157	case AF_INET:
2158		if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4)
2159			tunnel = true;
2160		break;
2161	case AF_INET6:
2162		if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6)
2163			tunnel = true;
2164		break;
2165	}
2166	if (tunnel && !(x->outer_mode.flags & XFRM_MODE_FLAG_TUNNEL))
2167		return -EINVAL;
2168
2169	return 0;
2170}
2171
2172extern const int xfrm_msg_min[XFRM_NR_MSGTYPES];
2173extern const struct nla_policy xfrma_policy[XFRMA_MAX+1];
2174
2175struct xfrm_translator {
2176	/* Allocate frag_list and put compat translation there */
2177	int (*alloc_compat)(struct sk_buff *skb, const struct nlmsghdr *src);
2178
2179	/* Allocate nlmsg with 64-bit translaton of received 32-bit message */
2180	struct nlmsghdr *(*rcv_msg_compat)(const struct nlmsghdr *nlh,
2181			int maxtype, const struct nla_policy *policy,
2182			struct netlink_ext_ack *extack);
2183
2184	/* Translate 32-bit user_policy from sockptr */
2185	int (*xlate_user_policy_sockptr)(u8 **pdata32, int optlen);
2186
2187	struct module *owner;
2188};
2189
2190#if IS_ENABLED(CONFIG_XFRM_USER_COMPAT)
2191extern int xfrm_register_translator(struct xfrm_translator *xtr);
2192extern int xfrm_unregister_translator(struct xfrm_translator *xtr);
2193extern struct xfrm_translator *xfrm_get_translator(void);
2194extern void xfrm_put_translator(struct xfrm_translator *xtr);
2195#else
2196static inline struct xfrm_translator *xfrm_get_translator(void)
2197{
2198	return NULL;
2199}
2200static inline void xfrm_put_translator(struct xfrm_translator *xtr)
2201{
2202}
2203#endif
2204
2205#if IS_ENABLED(CONFIG_IPV6)
2206static inline bool xfrm6_local_dontfrag(const struct sock *sk)
2207{
2208	int proto;
2209
2210	if (!sk || sk->sk_family != AF_INET6)
2211		return false;
2212
2213	proto = sk->sk_protocol;
2214	if (proto == IPPROTO_UDP || proto == IPPROTO_RAW)
2215		return inet6_test_bit(DONTFRAG, sk);
2216
2217	return false;
2218}
2219#endif
2220
2221#if (IS_BUILTIN(CONFIG_XFRM_INTERFACE) && IS_ENABLED(CONFIG_DEBUG_INFO_BTF)) || \
2222    (IS_MODULE(CONFIG_XFRM_INTERFACE) && IS_ENABLED(CONFIG_DEBUG_INFO_BTF_MODULES))
2223
2224extern struct metadata_dst __percpu *xfrm_bpf_md_dst;
2225
2226int register_xfrm_interface_bpf(void);
2227
2228#else
2229
2230static inline int register_xfrm_interface_bpf(void)
2231{
2232	return 0;
2233}
2234
2235#endif
2236
2237#if IS_ENABLED(CONFIG_DEBUG_INFO_BTF)
2238int register_xfrm_state_bpf(void);
2239#else
2240static inline int register_xfrm_state_bpf(void)
2241{
2242	return 0;
2243}
2244#endif
2245
2246int xfrm_nat_keepalive_init(unsigned short family);
2247void xfrm_nat_keepalive_fini(unsigned short family);
2248int xfrm_nat_keepalive_net_init(struct net *net);
2249int xfrm_nat_keepalive_net_fini(struct net *net);
2250void xfrm_nat_keepalive_state_updated(struct xfrm_state *x);
2251
2252#endif	/* _NET_XFRM_H */