1/* SPDX-License-Identifier: GPL-2.0 */
   2#ifndef _NET_XFRM_H
   3#define _NET_XFRM_H
   4
   5#include <linux/compiler.h>
   6#include <linux/xfrm.h>
   7#include <linux/spinlock.h>
   8#include <linux/list.h>
   9#include <linux/skbuff.h>
  10#include <linux/socket.h>
  11#include <linux/pfkeyv2.h>
  12#include <linux/ipsec.h>
  13#include <linux/in6.h>
  14#include <linux/mutex.h>
  15#include <linux/audit.h>
  16#include <linux/slab.h>
  17#include <linux/refcount.h>
  18#include <linux/sockptr.h>
  19
  20#include <net/sock.h>
  21#include <net/dst.h>
  22#include <net/ip.h>
  23#include <net/route.h>
  24#include <net/ipv6.h>
  25#include <net/ip6_fib.h>
  26#include <net/flow.h>
  27#include <net/gro_cells.h>
  28
  29#include <linux/interrupt.h>
  30
  31#ifdef CONFIG_XFRM_STATISTICS
  32#include <net/snmp.h>
  33#endif
  34
  35#define XFRM_PROTO_ESP		50
  36#define XFRM_PROTO_AH		51
  37#define XFRM_PROTO_COMP		108
  38#define XFRM_PROTO_IPIP		4
  39#define XFRM_PROTO_IPV6		41
  40#define XFRM_PROTO_ROUTING	IPPROTO_ROUTING
  41#define XFRM_PROTO_DSTOPTS	IPPROTO_DSTOPTS
  42
  43#define XFRM_ALIGN4(len)	(((len) + 3) & ~3)
  44#define XFRM_ALIGN8(len)	(((len) + 7) & ~7)
  45#define MODULE_ALIAS_XFRM_MODE(family, encap) \
  46	MODULE_ALIAS("xfrm-mode-" __stringify(family) "-" __stringify(encap))
  47#define MODULE_ALIAS_XFRM_TYPE(family, proto) \
  48	MODULE_ALIAS("xfrm-type-" __stringify(family) "-" __stringify(proto))
  49#define MODULE_ALIAS_XFRM_OFFLOAD_TYPE(family, proto) \
  50	MODULE_ALIAS("xfrm-offload-" __stringify(family) "-" __stringify(proto))
  51
  52#ifdef CONFIG_XFRM_STATISTICS
  53#define XFRM_INC_STATS(net, field)	SNMP_INC_STATS((net)->mib.xfrm_statistics, field)
  54#else
  55#define XFRM_INC_STATS(net, field)	((void)(net))
  56#endif
  57
  58
  59/* Organization of SPD aka "XFRM rules"
  60   ------------------------------------
  61
  62   Basic objects:
  63   - policy rule, struct xfrm_policy (=SPD entry)
  64   - bundle of transformations, struct dst_entry == struct xfrm_dst (=SA bundle)
  65   - instance of a transformer, struct xfrm_state (=SA)
  66   - template to clone xfrm_state, struct xfrm_tmpl
  67
  68   SPD is plain linear list of xfrm_policy rules, ordered by priority.
  69   (To be compatible with existing pfkeyv2 implementations,
  70   many rules with priority of 0x7fffffff are allowed to exist and
  71   such rules are ordered in an unpredictable way, thanks to bsd folks.)
  72
  73   Lookup is plain linear search until the first match with selector.
  74
  75   If "action" is "block", then we prohibit the flow, otherwise:
  76   if "xfrms_nr" is zero, the flow passes untransformed. Otherwise,
  77   policy entry has list of up to XFRM_MAX_DEPTH transformations,
  78   described by templates xfrm_tmpl. Each template is resolved
  79   to a complete xfrm_state (see below) and we pack bundle of transformations
  80   to a dst_entry returned to requestor.
  81
  82   dst -. xfrm  .-> xfrm_state #1
  83    |---. child .-> dst -. xfrm .-> xfrm_state #2
  84                     |---. child .-> dst -. xfrm .-> xfrm_state #3
  85                                      |---. child .-> NULL
  86
  87   Bundles are cached at xrfm_policy struct (field ->bundles).
  88
  89
  90   Resolution of xrfm_tmpl
  91   -----------------------
  92   Template contains:
  93   1. ->mode		Mode: transport or tunnel
  94   2. ->id.proto	Protocol: AH/ESP/IPCOMP
  95   3. ->id.daddr	Remote tunnel endpoint, ignored for transport mode.
  96      Q: allow to resolve security gateway?
  97   4. ->id.spi          If not zero, static SPI.
  98   5. ->saddr		Local tunnel endpoint, ignored for transport mode.
  99   6. ->algos		List of allowed algos. Plain bitmask now.
 100      Q: ealgos, aalgos, calgos. What a mess...
 101   7. ->share		Sharing mode.
 102      Q: how to implement private sharing mode? To add struct sock* to
 103      flow id?
 104
 105   Having this template we search through SAD searching for entries
 106   with appropriate mode/proto/algo, permitted by selector.
 107   If no appropriate entry found, it is requested from key manager.
 108
 109   PROBLEMS:
 110   Q: How to find all the bundles referring to a physical path for
 111      PMTU discovery? Seems, dst should contain list of all parents...
 112      and enter to infinite locking hierarchy disaster.
 113      No! It is easier, we will not search for them, let them find us.
 114      We add genid to each dst plus pointer to genid of raw IP route,
 115      pmtu disc will update pmtu on raw IP route and increase its genid.
 116      dst_check() will see this for top level and trigger resyncing
 117      metrics. Plus, it will be made via sk->sk_dst_cache. Solved.
 118 */
 119
 120struct xfrm_state_walk {
 121	struct list_head	all;
 122	u8			state;
 123	u8			dying;
 124	u8			proto;
 125	u32			seq;
 126	struct xfrm_address_filter *filter;
 127};
 128
 129enum {
 130	XFRM_DEV_OFFLOAD_IN = 1,
 131	XFRM_DEV_OFFLOAD_OUT,
 132	XFRM_DEV_OFFLOAD_FWD,
 133};
 134
 135enum {
 136	XFRM_DEV_OFFLOAD_UNSPECIFIED,
 137	XFRM_DEV_OFFLOAD_CRYPTO,
 138	XFRM_DEV_OFFLOAD_PACKET,
 139};
 140
 141struct xfrm_dev_offload {
 142	struct net_device	*dev;
 143	netdevice_tracker	dev_tracker;
 144	struct net_device	*real_dev;
 145	unsigned long		offload_handle;
 146	u8			dir : 2;
 147	u8			type : 2;
 148};
 149
 150struct xfrm_mode {
 151	u8 encap;
 152	u8 family;
 153	u8 flags;
 154};
 155
 156/* Flags for xfrm_mode. */
 157enum {
 158	XFRM_MODE_FLAG_TUNNEL = 1,
 159};
 160
 161enum xfrm_replay_mode {
 162	XFRM_REPLAY_MODE_LEGACY,
 163	XFRM_REPLAY_MODE_BMP,
 164	XFRM_REPLAY_MODE_ESN,
 165};
 166
 167/* Full description of state of transformer. */
 168struct xfrm_state {
 169	possible_net_t		xs_net;
 170	union {
 171		struct hlist_node	gclist;
 172		struct hlist_node	bydst;
 173	};
 174	struct hlist_node	bysrc;
 175	struct hlist_node	byspi;
 176	struct hlist_node	byseq;
 177
 178	refcount_t		refcnt;
 179	spinlock_t		lock;
 180
 181	struct xfrm_id		id;
 182	struct xfrm_selector	sel;
 183	struct xfrm_mark	mark;
 184	u32			if_id;
 185	u32			tfcpad;
 186
 187	u32			genid;
 188
 189	/* Key manager bits */
 190	struct xfrm_state_walk	km;
 191
 192	/* Parameters of this state. */
 193	struct {
 194		u32		reqid;
 195		u8		mode;
 196		u8		replay_window;
 197		u8		aalgo, ealgo, calgo;
 198		u8		flags;
 199		u16		family;
 200		xfrm_address_t	saddr;
 201		int		header_len;
 202		int		trailer_len;
 203		u32		extra_flags;
 204		struct xfrm_mark	smark;
 205	} props;
 206
 207	struct xfrm_lifetime_cfg lft;
 208
 209	/* Data for transformer */
 210	struct xfrm_algo_auth	*aalg;
 211	struct xfrm_algo	*ealg;
 212	struct xfrm_algo	*calg;
 213	struct xfrm_algo_aead	*aead;
 214	const char		*geniv;
 215
 216	/* mapping change rate limiting */
 217	__be16 new_mapping_sport;
 218	u32 new_mapping;	/* seconds */
 219	u32 mapping_maxage;	/* seconds for input SA */
 220
 221	/* Data for encapsulator */
 222	struct xfrm_encap_tmpl	*encap;
 223	struct sock __rcu	*encap_sk;
 224
 225	/* Data for care-of address */
 226	xfrm_address_t	*coaddr;
 227
 228	/* IPComp needs an IPIP tunnel for handling uncompressed packets */
 229	struct xfrm_state	*tunnel;
 230
 231	/* If a tunnel, number of users + 1 */
 232	atomic_t		tunnel_users;
 233
 234	/* State for replay detection */
 235	struct xfrm_replay_state replay;
 236	struct xfrm_replay_state_esn *replay_esn;
 237
 238	/* Replay detection state at the time we sent the last notification */
 239	struct xfrm_replay_state preplay;
 240	struct xfrm_replay_state_esn *preplay_esn;
 241
 242	/* replay detection mode */
 243	enum xfrm_replay_mode    repl_mode;
 
 244	/* internal flag that only holds state for delayed aevent at the
 245	 * moment
 246	*/
 247	u32			xflags;
 248
 249	/* Replay detection notification settings */
 250	u32			replay_maxage;
 251	u32			replay_maxdiff;
 252
 253	/* Replay detection notification timer */
 254	struct timer_list	rtimer;
 255
 256	/* Statistics */
 257	struct xfrm_stats	stats;
 258
 259	struct xfrm_lifetime_cur curlft;
 260	struct hrtimer		mtimer;
 261
 262	struct xfrm_dev_offload xso;
 263
 264	/* used to fix curlft->add_time when changing date */
 265	long		saved_tmo;
 266
 267	/* Last used time */
 268	time64_t		lastused;
 269
 270	struct page_frag xfrag;
 271
 272	/* Reference to data common to all the instances of this
 273	 * transformer. */
 274	const struct xfrm_type	*type;
 275	struct xfrm_mode	inner_mode;
 276	struct xfrm_mode	inner_mode_iaf;
 277	struct xfrm_mode	outer_mode;
 278
 279	const struct xfrm_type_offload	*type_offload;
 280
 281	/* Security context */
 282	struct xfrm_sec_ctx	*security;
 283
 284	/* Private data of this transformer, format is opaque,
 285	 * interpreted by xfrm_type methods. */
 286	void			*data;
 287};
 288
 289static inline struct net *xs_net(struct xfrm_state *x)
 290{
 291	return read_pnet(&x->xs_net);
 292}
 293
 294/* xflags - make enum if more show up */
 295#define XFRM_TIME_DEFER	1
 296#define XFRM_SOFT_EXPIRE 2
 297
 298enum {
 299	XFRM_STATE_VOID,
 300	XFRM_STATE_ACQ,
 301	XFRM_STATE_VALID,
 302	XFRM_STATE_ERROR,
 303	XFRM_STATE_EXPIRED,
 304	XFRM_STATE_DEAD
 305};
 306
 307/* callback structure passed from either netlink or pfkey */
 308struct km_event {
 309	union {
 310		u32 hard;
 311		u32 proto;
 312		u32 byid;
 313		u32 aevent;
 314		u32 type;
 315	} data;
 316
 317	u32	seq;
 318	u32	portid;
 319	u32	event;
 320	struct net *net;
 321};
 322
 323struct xfrm_if_decode_session_result {
 324	struct net *net;
 325	u32 if_id;
 
 
 
 
 
 
 
 326};
 327
 328struct xfrm_if_cb {
 329	bool (*decode_session)(struct sk_buff *skb,
 330			       unsigned short family,
 331			       struct xfrm_if_decode_session_result *res);
 332};
 333
 334void xfrm_if_register_cb(const struct xfrm_if_cb *ifcb);
 335void xfrm_if_unregister_cb(void);
 336
 337struct net_device;
 338struct xfrm_type;
 339struct xfrm_dst;
 340struct xfrm_policy_afinfo {
 341	struct dst_ops		*dst_ops;
 342	struct dst_entry	*(*dst_lookup)(struct net *net,
 343					       int tos, int oif,
 344					       const xfrm_address_t *saddr,
 345					       const xfrm_address_t *daddr,
 346					       u32 mark);
 347	int			(*get_saddr)(struct net *net, int oif,
 348					     xfrm_address_t *saddr,
 349					     xfrm_address_t *daddr,
 350					     u32 mark);
 351	int			(*fill_dst)(struct xfrm_dst *xdst,
 352					    struct net_device *dev,
 353					    const struct flowi *fl);
 354	struct dst_entry	*(*blackhole_route)(struct net *net, struct dst_entry *orig);
 355};
 356
 357int xfrm_policy_register_afinfo(const struct xfrm_policy_afinfo *afinfo, int family);
 358void xfrm_policy_unregister_afinfo(const struct xfrm_policy_afinfo *afinfo);
 359void km_policy_notify(struct xfrm_policy *xp, int dir,
 360		      const struct km_event *c);
 361void km_state_notify(struct xfrm_state *x, const struct km_event *c);
 362
 363struct xfrm_tmpl;
 364int km_query(struct xfrm_state *x, struct xfrm_tmpl *t,
 365	     struct xfrm_policy *pol);
 366void km_state_expired(struct xfrm_state *x, int hard, u32 portid);
 367int __xfrm_state_delete(struct xfrm_state *x);
 368
 369struct xfrm_state_afinfo {
 370	u8				family;
 371	u8				proto;
 372
 373	const struct xfrm_type_offload *type_offload_esp;
 374
 375	const struct xfrm_type		*type_esp;
 376	const struct xfrm_type		*type_ipip;
 377	const struct xfrm_type		*type_ipip6;
 378	const struct xfrm_type		*type_comp;
 379	const struct xfrm_type		*type_ah;
 380	const struct xfrm_type		*type_routing;
 381	const struct xfrm_type		*type_dstopts;
 382
 383	int			(*output)(struct net *net, struct sock *sk, struct sk_buff *skb);
 384	int			(*transport_finish)(struct sk_buff *skb,
 385						    int async);
 386	void			(*local_error)(struct sk_buff *skb, u32 mtu);
 387};
 388
 389int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo);
 390int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo);
 391struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family);
 392struct xfrm_state_afinfo *xfrm_state_afinfo_get_rcu(unsigned int family);
 393
 394struct xfrm_input_afinfo {
 395	u8			family;
 396	bool			is_ipip;
 397	int			(*callback)(struct sk_buff *skb, u8 protocol,
 398					    int err);
 399};
 400
 401int xfrm_input_register_afinfo(const struct xfrm_input_afinfo *afinfo);
 402int xfrm_input_unregister_afinfo(const struct xfrm_input_afinfo *afinfo);
 403
 404void xfrm_flush_gc(void);
 405void xfrm_state_delete_tunnel(struct xfrm_state *x);
 406
 407struct xfrm_type {
 
 408	struct module		*owner;
 409	u8			proto;
 410	u8			flags;
 411#define XFRM_TYPE_NON_FRAGMENT	1
 412#define XFRM_TYPE_REPLAY_PROT	2
 413#define XFRM_TYPE_LOCAL_COADDR	4
 414#define XFRM_TYPE_REMOTE_COADDR	8
 415
 416	int			(*init_state)(struct xfrm_state *x,
 417					      struct netlink_ext_ack *extack);
 418	void			(*destructor)(struct xfrm_state *);
 419	int			(*input)(struct xfrm_state *, struct sk_buff *skb);
 420	int			(*output)(struct xfrm_state *, struct sk_buff *pskb);
 421	int			(*reject)(struct xfrm_state *, struct sk_buff *,
 422					  const struct flowi *);
 
 423};
 424
 425int xfrm_register_type(const struct xfrm_type *type, unsigned short family);
 426void xfrm_unregister_type(const struct xfrm_type *type, unsigned short family);
 427
 428struct xfrm_type_offload {
 
 429	struct module	*owner;
 430	u8		proto;
 431	void		(*encap)(struct xfrm_state *, struct sk_buff *pskb);
 432	int		(*input_tail)(struct xfrm_state *x, struct sk_buff *skb);
 433	int		(*xmit)(struct xfrm_state *, struct sk_buff *pskb, netdev_features_t features);
 434};
 435
 436int xfrm_register_type_offload(const struct xfrm_type_offload *type, unsigned short family);
 437void xfrm_unregister_type_offload(const struct xfrm_type_offload *type, unsigned short family);
 438
 439static inline int xfrm_af2proto(unsigned int family)
 440{
 441	switch(family) {
 442	case AF_INET:
 443		return IPPROTO_IPIP;
 444	case AF_INET6:
 445		return IPPROTO_IPV6;
 446	default:
 447		return 0;
 448	}
 449}
 450
 451static inline const struct xfrm_mode *xfrm_ip2inner_mode(struct xfrm_state *x, int ipproto)
 452{
 453	if ((ipproto == IPPROTO_IPIP && x->props.family == AF_INET) ||
 454	    (ipproto == IPPROTO_IPV6 && x->props.family == AF_INET6))
 455		return &x->inner_mode;
 456	else
 457		return &x->inner_mode_iaf;
 458}
 459
 460struct xfrm_tmpl {
 461/* id in template is interpreted as:
 462 * daddr - destination of tunnel, may be zero for transport mode.
 463 * spi   - zero to acquire spi. Not zero if spi is static, then
 464 *	   daddr must be fixed too.
 465 * proto - AH/ESP/IPCOMP
 466 */
 467	struct xfrm_id		id;
 468
 469/* Source address of tunnel. Ignored, if it is not a tunnel. */
 470	xfrm_address_t		saddr;
 471
 472	unsigned short		encap_family;
 473
 474	u32			reqid;
 475
 476/* Mode: transport, tunnel etc. */
 477	u8			mode;
 478
 479/* Sharing mode: unique, this session only, this user only etc. */
 480	u8			share;
 481
 482/* May skip this transfomration if no SA is found */
 483	u8			optional;
 484
 485/* Skip aalgos/ealgos/calgos checks. */
 486	u8			allalgs;
 487
 488/* Bit mask of algos allowed for acquisition */
 489	u32			aalgos;
 490	u32			ealgos;
 491	u32			calgos;
 492};
 493
 494#define XFRM_MAX_DEPTH		6
 495#define XFRM_MAX_OFFLOAD_DEPTH	1
 496
 497struct xfrm_policy_walk_entry {
 498	struct list_head	all;
 499	u8			dead;
 500};
 501
 502struct xfrm_policy_walk {
 503	struct xfrm_policy_walk_entry walk;
 504	u8 type;
 505	u32 seq;
 506};
 507
 508struct xfrm_policy_queue {
 509	struct sk_buff_head	hold_queue;
 510	struct timer_list	hold_timer;
 511	unsigned long		timeout;
 512};
 513
 514struct xfrm_policy {
 515	possible_net_t		xp_net;
 516	struct hlist_node	bydst;
 517	struct hlist_node	byidx;
 518
 519	/* This lock only affects elements except for entry. */
 520	rwlock_t		lock;
 521	refcount_t		refcnt;
 522	u32			pos;
 523	struct timer_list	timer;
 524
 525	atomic_t		genid;
 526	u32			priority;
 527	u32			index;
 528	u32			if_id;
 529	struct xfrm_mark	mark;
 530	struct xfrm_selector	selector;
 531	struct xfrm_lifetime_cfg lft;
 532	struct xfrm_lifetime_cur curlft;
 533	struct xfrm_policy_walk_entry walk;
 534	struct xfrm_policy_queue polq;
 535	bool                    bydst_reinsert;
 536	u8			type;
 537	u8			action;
 538	u8			flags;
 539	u8			xfrm_nr;
 540	u16			family;
 541	struct xfrm_sec_ctx	*security;
 542	struct xfrm_tmpl       	xfrm_vec[XFRM_MAX_DEPTH];
 543	struct hlist_node	bydst_inexact_list;
 544	struct rcu_head		rcu;
 545
 546	struct xfrm_dev_offload xdo;
 547};
 548
 549static inline struct net *xp_net(const struct xfrm_policy *xp)
 550{
 551	return read_pnet(&xp->xp_net);
 552}
 553
 554struct xfrm_kmaddress {
 555	xfrm_address_t          local;
 556	xfrm_address_t          remote;
 557	u32			reserved;
 558	u16			family;
 559};
 560
 561struct xfrm_migrate {
 562	xfrm_address_t		old_daddr;
 563	xfrm_address_t		old_saddr;
 564	xfrm_address_t		new_daddr;
 565	xfrm_address_t		new_saddr;
 566	u8			proto;
 567	u8			mode;
 568	u16			reserved;
 569	u32			reqid;
 570	u16			old_family;
 571	u16			new_family;
 572};
 573
 574#define XFRM_KM_TIMEOUT                30
 575/* what happened */
 576#define XFRM_REPLAY_UPDATE	XFRM_AE_CR
 577#define XFRM_REPLAY_TIMEOUT	XFRM_AE_CE
 578
 579/* default aevent timeout in units of 100ms */
 580#define XFRM_AE_ETIME			10
 581/* Async Event timer multiplier */
 582#define XFRM_AE_ETH_M			10
 583/* default seq threshold size */
 584#define XFRM_AE_SEQT_SIZE		2
 585
 586struct xfrm_mgr {
 587	struct list_head	list;
 588	int			(*notify)(struct xfrm_state *x, const struct km_event *c);
 589	int			(*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp);
 590	struct xfrm_policy	*(*compile_policy)(struct sock *sk, int opt, u8 *data, int len, int *dir);
 591	int			(*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
 592	int			(*notify_policy)(struct xfrm_policy *x, int dir, const struct km_event *c);
 593	int			(*report)(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr);
 594	int			(*migrate)(const struct xfrm_selector *sel,
 595					   u8 dir, u8 type,
 596					   const struct xfrm_migrate *m,
 597					   int num_bundles,
 598					   const struct xfrm_kmaddress *k,
 599					   const struct xfrm_encap_tmpl *encap);
 600	bool			(*is_alive)(const struct km_event *c);
 601};
 602
 603void xfrm_register_km(struct xfrm_mgr *km);
 604void xfrm_unregister_km(struct xfrm_mgr *km);
 605
 606struct xfrm_tunnel_skb_cb {
 607	union {
 608		struct inet_skb_parm h4;
 609		struct inet6_skb_parm h6;
 610	} header;
 611
 612	union {
 613		struct ip_tunnel *ip4;
 614		struct ip6_tnl *ip6;
 615	} tunnel;
 616};
 617
 618#define XFRM_TUNNEL_SKB_CB(__skb) ((struct xfrm_tunnel_skb_cb *)&((__skb)->cb[0]))
 619
 620/*
 621 * This structure is used for the duration where packets are being
 622 * transformed by IPsec.  As soon as the packet leaves IPsec the
 623 * area beyond the generic IP part may be overwritten.
 624 */
 625struct xfrm_skb_cb {
 626	struct xfrm_tunnel_skb_cb header;
 627
 628        /* Sequence number for replay protection. */
 629	union {
 630		struct {
 631			__u32 low;
 632			__u32 hi;
 633		} output;
 634		struct {
 635			__be32 low;
 636			__be32 hi;
 637		} input;
 638	} seq;
 639};
 640
 641#define XFRM_SKB_CB(__skb) ((struct xfrm_skb_cb *)&((__skb)->cb[0]))
 642
 643/*
 644 * This structure is used by the afinfo prepare_input/prepare_output functions
 645 * to transmit header information to the mode input/output functions.
 646 */
 647struct xfrm_mode_skb_cb {
 648	struct xfrm_tunnel_skb_cb header;
 649
 650	/* Copied from header for IPv4, always set to zero and DF for IPv6. */
 651	__be16 id;
 652	__be16 frag_off;
 653
 654	/* IP header length (excluding options or extension headers). */
 655	u8 ihl;
 656
 657	/* TOS for IPv4, class for IPv6. */
 658	u8 tos;
 659
 660	/* TTL for IPv4, hop limitfor IPv6. */
 661	u8 ttl;
 662
 663	/* Protocol for IPv4, NH for IPv6. */
 664	u8 protocol;
 665
 666	/* Option length for IPv4, zero for IPv6. */
 667	u8 optlen;
 668
 669	/* Used by IPv6 only, zero for IPv4. */
 670	u8 flow_lbl[3];
 671};
 672
 673#define XFRM_MODE_SKB_CB(__skb) ((struct xfrm_mode_skb_cb *)&((__skb)->cb[0]))
 674
 675/*
 676 * This structure is used by the input processing to locate the SPI and
 677 * related information.
 678 */
 679struct xfrm_spi_skb_cb {
 680	struct xfrm_tunnel_skb_cb header;
 681
 682	unsigned int daddroff;
 683	unsigned int family;
 684	__be32 seq;
 685};
 686
 687#define XFRM_SPI_SKB_CB(__skb) ((struct xfrm_spi_skb_cb *)&((__skb)->cb[0]))
 688
 689#ifdef CONFIG_AUDITSYSCALL
 690static inline struct audit_buffer *xfrm_audit_start(const char *op)
 691{
 692	struct audit_buffer *audit_buf = NULL;
 693
 694	if (audit_enabled == AUDIT_OFF)
 695		return NULL;
 696	audit_buf = audit_log_start(audit_context(), GFP_ATOMIC,
 697				    AUDIT_MAC_IPSEC_EVENT);
 698	if (audit_buf == NULL)
 699		return NULL;
 700	audit_log_format(audit_buf, "op=%s", op);
 701	return audit_buf;
 702}
 703
 704static inline void xfrm_audit_helper_usrinfo(bool task_valid,
 705					     struct audit_buffer *audit_buf)
 706{
 707	const unsigned int auid = from_kuid(&init_user_ns, task_valid ?
 708					    audit_get_loginuid(current) :
 709					    INVALID_UID);
 710	const unsigned int ses = task_valid ? audit_get_sessionid(current) :
 711		AUDIT_SID_UNSET;
 712
 713	audit_log_format(audit_buf, " auid=%u ses=%u", auid, ses);
 714	audit_log_task_context(audit_buf);
 715}
 716
 717void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, bool task_valid);
 718void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
 719			      bool task_valid);
 720void xfrm_audit_state_add(struct xfrm_state *x, int result, bool task_valid);
 721void xfrm_audit_state_delete(struct xfrm_state *x, int result, bool task_valid);
 722void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
 723				      struct sk_buff *skb);
 724void xfrm_audit_state_replay(struct xfrm_state *x, struct sk_buff *skb,
 725			     __be32 net_seq);
 726void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family);
 727void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, __be32 net_spi,
 728			       __be32 net_seq);
 729void xfrm_audit_state_icvfail(struct xfrm_state *x, struct sk_buff *skb,
 730			      u8 proto);
 731#else
 732
 733static inline void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
 734					 bool task_valid)
 735{
 736}
 737
 738static inline void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
 739					    bool task_valid)
 740{
 741}
 742
 743static inline void xfrm_audit_state_add(struct xfrm_state *x, int result,
 744					bool task_valid)
 745{
 746}
 747
 748static inline void xfrm_audit_state_delete(struct xfrm_state *x, int result,
 749					   bool task_valid)
 750{
 751}
 752
 753static inline void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
 754					     struct sk_buff *skb)
 755{
 756}
 757
 758static inline void xfrm_audit_state_replay(struct xfrm_state *x,
 759					   struct sk_buff *skb, __be32 net_seq)
 760{
 761}
 762
 763static inline void xfrm_audit_state_notfound_simple(struct sk_buff *skb,
 764				      u16 family)
 765{
 766}
 767
 768static inline void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
 769				      __be32 net_spi, __be32 net_seq)
 770{
 771}
 772
 773static inline void xfrm_audit_state_icvfail(struct xfrm_state *x,
 774				     struct sk_buff *skb, u8 proto)
 775{
 776}
 777#endif /* CONFIG_AUDITSYSCALL */
 778
 779static inline void xfrm_pol_hold(struct xfrm_policy *policy)
 780{
 781	if (likely(policy != NULL))
 782		refcount_inc(&policy->refcnt);
 783}
 784
 785void xfrm_policy_destroy(struct xfrm_policy *policy);
 786
 787static inline void xfrm_pol_put(struct xfrm_policy *policy)
 788{
 789	if (refcount_dec_and_test(&policy->refcnt))
 790		xfrm_policy_destroy(policy);
 791}
 792
 793static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols)
 794{
 795	int i;
 796	for (i = npols - 1; i >= 0; --i)
 797		xfrm_pol_put(pols[i]);
 798}
 799
 800void __xfrm_state_destroy(struct xfrm_state *, bool);
 801
 802static inline void __xfrm_state_put(struct xfrm_state *x)
 803{
 804	refcount_dec(&x->refcnt);
 805}
 806
 807static inline void xfrm_state_put(struct xfrm_state *x)
 808{
 809	if (refcount_dec_and_test(&x->refcnt))
 810		__xfrm_state_destroy(x, false);
 811}
 812
 813static inline void xfrm_state_put_sync(struct xfrm_state *x)
 814{
 815	if (refcount_dec_and_test(&x->refcnt))
 816		__xfrm_state_destroy(x, true);
 817}
 818
 819static inline void xfrm_state_hold(struct xfrm_state *x)
 820{
 821	refcount_inc(&x->refcnt);
 822}
 823
 824static inline bool addr_match(const void *token1, const void *token2,
 825			      unsigned int prefixlen)
 826{
 827	const __be32 *a1 = token1;
 828	const __be32 *a2 = token2;
 829	unsigned int pdw;
 830	unsigned int pbi;
 831
 832	pdw = prefixlen >> 5;	  /* num of whole u32 in prefix */
 833	pbi = prefixlen &  0x1f;  /* num of bits in incomplete u32 in prefix */
 834
 835	if (pdw)
 836		if (memcmp(a1, a2, pdw << 2))
 837			return false;
 838
 839	if (pbi) {
 840		__be32 mask;
 841
 842		mask = htonl((0xffffffff) << (32 - pbi));
 843
 844		if ((a1[pdw] ^ a2[pdw]) & mask)
 845			return false;
 846	}
 847
 848	return true;
 849}
 850
 851static inline bool addr4_match(__be32 a1, __be32 a2, u8 prefixlen)
 852{
 853	/* C99 6.5.7 (3): u32 << 32 is undefined behaviour */
 854	if (sizeof(long) == 4 && prefixlen == 0)
 855		return true;
 856	return !((a1 ^ a2) & htonl(~0UL << (32 - prefixlen)));
 857}
 858
 859static __inline__
 860__be16 xfrm_flowi_sport(const struct flowi *fl, const union flowi_uli *uli)
 861{
 862	__be16 port;
 863	switch(fl->flowi_proto) {
 864	case IPPROTO_TCP:
 865	case IPPROTO_UDP:
 866	case IPPROTO_UDPLITE:
 867	case IPPROTO_SCTP:
 868		port = uli->ports.sport;
 869		break;
 870	case IPPROTO_ICMP:
 871	case IPPROTO_ICMPV6:
 872		port = htons(uli->icmpt.type);
 873		break;
 874	case IPPROTO_MH:
 875		port = htons(uli->mht.type);
 876		break;
 877	case IPPROTO_GRE:
 878		port = htons(ntohl(uli->gre_key) >> 16);
 879		break;
 880	default:
 881		port = 0;	/*XXX*/
 882	}
 883	return port;
 884}
 885
 886static __inline__
 887__be16 xfrm_flowi_dport(const struct flowi *fl, const union flowi_uli *uli)
 888{
 889	__be16 port;
 890	switch(fl->flowi_proto) {
 891	case IPPROTO_TCP:
 892	case IPPROTO_UDP:
 893	case IPPROTO_UDPLITE:
 894	case IPPROTO_SCTP:
 895		port = uli->ports.dport;
 896		break;
 897	case IPPROTO_ICMP:
 898	case IPPROTO_ICMPV6:
 899		port = htons(uli->icmpt.code);
 900		break;
 901	case IPPROTO_GRE:
 902		port = htons(ntohl(uli->gre_key) & 0xffff);
 903		break;
 904	default:
 905		port = 0;	/*XXX*/
 906	}
 907	return port;
 908}
 909
 910bool xfrm_selector_match(const struct xfrm_selector *sel,
 911			 const struct flowi *fl, unsigned short family);
 912
 913#ifdef CONFIG_SECURITY_NETWORK_XFRM
 914/*	If neither has a context --> match
 915 * 	Otherwise, both must have a context and the sids, doi, alg must match
 916 */
 917static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
 918{
 919	return ((!s1 && !s2) ||
 920		(s1 && s2 &&
 921		 (s1->ctx_sid == s2->ctx_sid) &&
 922		 (s1->ctx_doi == s2->ctx_doi) &&
 923		 (s1->ctx_alg == s2->ctx_alg)));
 924}
 925#else
 926static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
 927{
 928	return true;
 929}
 930#endif
 931
 932/* A struct encoding bundle of transformations to apply to some set of flow.
 933 *
 934 * xdst->child points to the next element of bundle.
 935 * dst->xfrm  points to an instanse of transformer.
 936 *
 937 * Due to unfortunate limitations of current routing cache, which we
 938 * have no time to fix, it mirrors struct rtable and bound to the same
 939 * routing key, including saddr,daddr. However, we can have many of
 940 * bundles differing by session id. All the bundles grow from a parent
 941 * policy rule.
 942 */
 943struct xfrm_dst {
 944	union {
 945		struct dst_entry	dst;
 946		struct rtable		rt;
 947		struct rt6_info		rt6;
 948	} u;
 949	struct dst_entry *route;
 950	struct dst_entry *child;
 951	struct dst_entry *path;
 952	struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX];
 953	int num_pols, num_xfrms;
 954	u32 xfrm_genid;
 955	u32 policy_genid;
 956	u32 route_mtu_cached;
 957	u32 child_mtu_cached;
 958	u32 route_cookie;
 959	u32 path_cookie;
 960};
 961
 962static inline struct dst_entry *xfrm_dst_path(const struct dst_entry *dst)
 963{
 964#ifdef CONFIG_XFRM
 965	if (dst->xfrm || (dst->flags & DST_XFRM_QUEUE)) {
 966		const struct xfrm_dst *xdst = (const struct xfrm_dst *) dst;
 967
 968		return xdst->path;
 969	}
 970#endif
 971	return (struct dst_entry *) dst;
 972}
 973
 974static inline struct dst_entry *xfrm_dst_child(const struct dst_entry *dst)
 975{
 976#ifdef CONFIG_XFRM
 977	if (dst->xfrm || (dst->flags & DST_XFRM_QUEUE)) {
 978		struct xfrm_dst *xdst = (struct xfrm_dst *) dst;
 979		return xdst->child;
 980	}
 981#endif
 982	return NULL;
 983}
 984
 985#ifdef CONFIG_XFRM
 986static inline void xfrm_dst_set_child(struct xfrm_dst *xdst, struct dst_entry *child)
 987{
 988	xdst->child = child;
 989}
 990
 991static inline void xfrm_dst_destroy(struct xfrm_dst *xdst)
 992{
 993	xfrm_pols_put(xdst->pols, xdst->num_pols);
 994	dst_release(xdst->route);
 995	if (likely(xdst->u.dst.xfrm))
 996		xfrm_state_put(xdst->u.dst.xfrm);
 997}
 998#endif
 999
1000void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev);
1001
1002struct xfrm_if_parms {
1003	int link;		/* ifindex of underlying L2 interface */
1004	u32 if_id;		/* interface identifyer */
1005	bool collect_md;
1006};
1007
1008struct xfrm_if {
1009	struct xfrm_if __rcu *next;	/* next interface in list */
1010	struct net_device *dev;		/* virtual device associated with interface */
1011	struct net *net;		/* netns for packet i/o */
1012	struct xfrm_if_parms p;		/* interface parms */
1013
1014	struct gro_cells gro_cells;
1015};
1016
1017struct xfrm_offload {
1018	/* Output sequence number for replay protection on offloading. */
1019	struct {
1020		__u32 low;
1021		__u32 hi;
1022	} seq;
1023
1024	__u32			flags;
1025#define	SA_DELETE_REQ		1
1026#define	CRYPTO_DONE		2
1027#define	CRYPTO_NEXT_DONE	4
1028#define	CRYPTO_FALLBACK		8
1029#define	XFRM_GSO_SEGMENT	16
1030#define	XFRM_GRO		32
1031/* 64 is free */
1032#define	XFRM_DEV_RESUME		128
1033#define	XFRM_XMIT		256
1034
1035	__u32			status;
1036#define CRYPTO_SUCCESS				1
1037#define CRYPTO_GENERIC_ERROR			2
1038#define CRYPTO_TRANSPORT_AH_AUTH_FAILED		4
1039#define CRYPTO_TRANSPORT_ESP_AUTH_FAILED	8
1040#define CRYPTO_TUNNEL_AH_AUTH_FAILED		16
1041#define CRYPTO_TUNNEL_ESP_AUTH_FAILED		32
1042#define CRYPTO_INVALID_PACKET_SYNTAX		64
1043#define CRYPTO_INVALID_PROTOCOL			128
1044
1045	__u8			proto;
1046	__u8			inner_ipproto;
1047};
1048
1049struct sec_path {
1050	int			len;
1051	int			olen;
1052
1053	struct xfrm_state	*xvec[XFRM_MAX_DEPTH];
1054	struct xfrm_offload	ovec[XFRM_MAX_OFFLOAD_DEPTH];
1055};
1056
1057struct sec_path *secpath_set(struct sk_buff *skb);
1058
1059static inline void
1060secpath_reset(struct sk_buff *skb)
1061{
1062#ifdef CONFIG_XFRM
1063	skb_ext_del(skb, SKB_EXT_SEC_PATH);
1064#endif
1065}
1066
1067static inline int
1068xfrm_addr_any(const xfrm_address_t *addr, unsigned short family)
1069{
1070	switch (family) {
1071	case AF_INET:
1072		return addr->a4 == 0;
1073	case AF_INET6:
1074		return ipv6_addr_any(&addr->in6);
1075	}
1076	return 0;
1077}
1078
1079static inline int
1080__xfrm4_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x)
1081{
1082	return	(tmpl->saddr.a4 &&
1083		 tmpl->saddr.a4 != x->props.saddr.a4);
1084}
1085
1086static inline int
1087__xfrm6_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x)
1088{
1089	return	(!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) &&
1090		 !ipv6_addr_equal((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr));
1091}
1092
1093static inline int
1094xfrm_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x, unsigned short family)
1095{
1096	switch (family) {
1097	case AF_INET:
1098		return __xfrm4_state_addr_cmp(tmpl, x);
1099	case AF_INET6:
1100		return __xfrm6_state_addr_cmp(tmpl, x);
1101	}
1102	return !0;
1103}
1104
1105#ifdef CONFIG_XFRM
1106static inline struct xfrm_state *xfrm_input_state(struct sk_buff *skb)
1107{
1108	struct sec_path *sp = skb_sec_path(skb);
1109
1110	return sp->xvec[sp->len - 1];
1111}
1112#endif
1113
1114static inline struct xfrm_offload *xfrm_offload(struct sk_buff *skb)
1115{
1116#ifdef CONFIG_XFRM
1117	struct sec_path *sp = skb_sec_path(skb);
1118
1119	if (!sp || !sp->olen || sp->len != sp->olen)
1120		return NULL;
1121
1122	return &sp->ovec[sp->olen - 1];
1123#else
1124	return NULL;
1125#endif
1126}
1127
1128#ifdef CONFIG_XFRM
1129int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb,
1130			unsigned short family);
1131
1132static inline bool __xfrm_check_nopolicy(struct net *net, struct sk_buff *skb,
1133					 int dir)
1134{
1135	if (!net->xfrm.policy_count[dir] && !secpath_exists(skb))
1136		return net->xfrm.policy_default[dir] == XFRM_USERPOLICY_ACCEPT;
1137
1138	return false;
1139}
1140
1141static inline bool __xfrm_check_dev_nopolicy(struct sk_buff *skb,
1142					     int dir, unsigned short family)
1143{
1144	if (dir != XFRM_POLICY_OUT && family == AF_INET) {
1145		/* same dst may be used for traffic originating from
1146		 * devices with different policy settings.
1147		 */
1148		return IPCB(skb)->flags & IPSKB_NOPOLICY;
1149	}
1150	return skb_dst(skb) && (skb_dst(skb)->flags & DST_NOPOLICY);
1151}
1152
1153static inline int __xfrm_policy_check2(struct sock *sk, int dir,
1154				       struct sk_buff *skb,
1155				       unsigned int family, int reverse)
1156{
1157	struct net *net = dev_net(skb->dev);
1158	int ndir = dir | (reverse ? XFRM_POLICY_MASK + 1 : 0);
1159	struct xfrm_offload *xo = xfrm_offload(skb);
1160	struct xfrm_state *x;
1161
1162	if (sk && sk->sk_policy[XFRM_POLICY_IN])
1163		return __xfrm_policy_check(sk, ndir, skb, family);
1164
1165	if (xo) {
1166		x = xfrm_input_state(skb);
1167		if (x->xso.type == XFRM_DEV_OFFLOAD_PACKET)
1168			return (xo->flags & CRYPTO_DONE) &&
1169			       (xo->status & CRYPTO_SUCCESS);
1170	}
1171
1172	return __xfrm_check_nopolicy(net, skb, dir) ||
1173	       __xfrm_check_dev_nopolicy(skb, dir, family) ||
1174	       __xfrm_policy_check(sk, ndir, skb, family);
1175}
1176
1177static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
1178{
1179	return __xfrm_policy_check2(sk, dir, skb, family, 0);
1180}
1181
1182static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1183{
1184	return xfrm_policy_check(sk, dir, skb, AF_INET);
1185}
1186
1187static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1188{
1189	return xfrm_policy_check(sk, dir, skb, AF_INET6);
1190}
1191
1192static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
1193					     struct sk_buff *skb)
1194{
1195	return __xfrm_policy_check2(sk, dir, skb, AF_INET, 1);
1196}
1197
1198static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
1199					     struct sk_buff *skb)
1200{
1201	return __xfrm_policy_check2(sk, dir, skb, AF_INET6, 1);
1202}
1203
1204int __xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
1205			  unsigned int family, int reverse);
1206
1207static inline int xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
1208				      unsigned int family)
1209{
1210	return __xfrm_decode_session(skb, fl, family, 0);
1211}
1212
1213static inline int xfrm_decode_session_reverse(struct sk_buff *skb,
1214					      struct flowi *fl,
1215					      unsigned int family)
1216{
1217	return __xfrm_decode_session(skb, fl, family, 1);
1218}
1219
1220int __xfrm_route_forward(struct sk_buff *skb, unsigned short family);
1221
1222static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family)
1223{
1224	struct net *net = dev_net(skb->dev);
1225
1226	if (!net->xfrm.policy_count[XFRM_POLICY_OUT] &&
1227	    net->xfrm.policy_default[XFRM_POLICY_OUT] == XFRM_USERPOLICY_ACCEPT)
1228		return true;
1229
1230	return (skb_dst(skb)->flags & DST_NOXFRM) ||
1231	       __xfrm_route_forward(skb, family);
1232}
1233
1234static inline int xfrm4_route_forward(struct sk_buff *skb)
1235{
1236	return xfrm_route_forward(skb, AF_INET);
1237}
1238
1239static inline int xfrm6_route_forward(struct sk_buff *skb)
1240{
1241	return xfrm_route_forward(skb, AF_INET6);
1242}
1243
1244int __xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk);
1245
1246static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk)
1247{
1248	if (!sk_fullsock(osk))
1249		return 0;
1250	sk->sk_policy[0] = NULL;
1251	sk->sk_policy[1] = NULL;
1252	if (unlikely(osk->sk_policy[0] || osk->sk_policy[1]))
1253		return __xfrm_sk_clone_policy(sk, osk);
1254	return 0;
1255}
1256
1257int xfrm_policy_delete(struct xfrm_policy *pol, int dir);
1258
1259static inline void xfrm_sk_free_policy(struct sock *sk)
1260{
1261	struct xfrm_policy *pol;
1262
1263	pol = rcu_dereference_protected(sk->sk_policy[0], 1);
1264	if (unlikely(pol != NULL)) {
1265		xfrm_policy_delete(pol, XFRM_POLICY_MAX);
1266		sk->sk_policy[0] = NULL;
1267	}
1268	pol = rcu_dereference_protected(sk->sk_policy[1], 1);
1269	if (unlikely(pol != NULL)) {
1270		xfrm_policy_delete(pol, XFRM_POLICY_MAX+1);
1271		sk->sk_policy[1] = NULL;
1272	}
1273}
1274
1275#else
1276
1277static inline void xfrm_sk_free_policy(struct sock *sk) {}
1278static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk) { return 0; }
1279static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; }
1280static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; }
1281static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1282{
1283	return 1;
1284}
1285static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1286{
1287	return 1;
1288}
1289static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
1290{
1291	return 1;
1292}
1293static inline int xfrm_decode_session_reverse(struct sk_buff *skb,
1294					      struct flowi *fl,
1295					      unsigned int family)
1296{
1297	return -ENOSYS;
1298}
1299static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
1300					     struct sk_buff *skb)
1301{
1302	return 1;
1303}
1304static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
1305					     struct sk_buff *skb)
1306{
1307	return 1;
1308}
1309#endif
1310
1311static __inline__
1312xfrm_address_t *xfrm_flowi_daddr(const struct flowi *fl, unsigned short family)
1313{
1314	switch (family){
1315	case AF_INET:
1316		return (xfrm_address_t *)&fl->u.ip4.daddr;
1317	case AF_INET6:
1318		return (xfrm_address_t *)&fl->u.ip6.daddr;
1319	}
1320	return NULL;
1321}
1322
1323static __inline__
1324xfrm_address_t *xfrm_flowi_saddr(const struct flowi *fl, unsigned short family)
1325{
1326	switch (family){
1327	case AF_INET:
1328		return (xfrm_address_t *)&fl->u.ip4.saddr;
1329	case AF_INET6:
1330		return (xfrm_address_t *)&fl->u.ip6.saddr;
1331	}
1332	return NULL;
1333}
1334
1335static __inline__
1336void xfrm_flowi_addr_get(const struct flowi *fl,
1337			 xfrm_address_t *saddr, xfrm_address_t *daddr,
1338			 unsigned short family)
1339{
1340	switch(family) {
1341	case AF_INET:
1342		memcpy(&saddr->a4, &fl->u.ip4.saddr, sizeof(saddr->a4));
1343		memcpy(&daddr->a4, &fl->u.ip4.daddr, sizeof(daddr->a4));
1344		break;
1345	case AF_INET6:
1346		saddr->in6 = fl->u.ip6.saddr;
1347		daddr->in6 = fl->u.ip6.daddr;
1348		break;
1349	}
1350}
1351
1352static __inline__ int
1353__xfrm4_state_addr_check(const struct xfrm_state *x,
1354			 const xfrm_address_t *daddr, const xfrm_address_t *saddr)
1355{
1356	if (daddr->a4 == x->id.daddr.a4 &&
1357	    (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4))
1358		return 1;
1359	return 0;
1360}
1361
1362static __inline__ int
1363__xfrm6_state_addr_check(const struct xfrm_state *x,
1364			 const xfrm_address_t *daddr, const xfrm_address_t *saddr)
1365{
1366	if (ipv6_addr_equal((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) &&
1367	    (ipv6_addr_equal((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr) ||
1368	     ipv6_addr_any((struct in6_addr *)saddr) ||
1369	     ipv6_addr_any((struct in6_addr *)&x->props.saddr)))
1370		return 1;
1371	return 0;
1372}
1373
1374static __inline__ int
1375xfrm_state_addr_check(const struct xfrm_state *x,
1376		      const xfrm_address_t *daddr, const xfrm_address_t *saddr,
1377		      unsigned short family)
1378{
1379	switch (family) {
1380	case AF_INET:
1381		return __xfrm4_state_addr_check(x, daddr, saddr);
1382	case AF_INET6:
1383		return __xfrm6_state_addr_check(x, daddr, saddr);
1384	}
1385	return 0;
1386}
1387
1388static __inline__ int
1389xfrm_state_addr_flow_check(const struct xfrm_state *x, const struct flowi *fl,
1390			   unsigned short family)
1391{
1392	switch (family) {
1393	case AF_INET:
1394		return __xfrm4_state_addr_check(x,
1395						(const xfrm_address_t *)&fl->u.ip4.daddr,
1396						(const xfrm_address_t *)&fl->u.ip4.saddr);
1397	case AF_INET6:
1398		return __xfrm6_state_addr_check(x,
1399						(const xfrm_address_t *)&fl->u.ip6.daddr,
1400						(const xfrm_address_t *)&fl->u.ip6.saddr);
1401	}
1402	return 0;
1403}
1404
1405static inline int xfrm_state_kern(const struct xfrm_state *x)
1406{
1407	return atomic_read(&x->tunnel_users);
1408}
1409
1410static inline bool xfrm_id_proto_valid(u8 proto)
1411{
1412	switch (proto) {
1413	case IPPROTO_AH:
1414	case IPPROTO_ESP:
1415	case IPPROTO_COMP:
1416#if IS_ENABLED(CONFIG_IPV6)
1417	case IPPROTO_ROUTING:
1418	case IPPROTO_DSTOPTS:
1419#endif
1420		return true;
1421	default:
1422		return false;
1423	}
1424}
1425
1426/* IPSEC_PROTO_ANY only matches 3 IPsec protocols, 0 could match all. */
1427static inline int xfrm_id_proto_match(u8 proto, u8 userproto)
1428{
1429	return (!userproto || proto == userproto ||
1430		(userproto == IPSEC_PROTO_ANY && (proto == IPPROTO_AH ||
1431						  proto == IPPROTO_ESP ||
1432						  proto == IPPROTO_COMP)));
1433}
1434
1435/*
1436 * xfrm algorithm information
1437 */
1438struct xfrm_algo_aead_info {
1439	char *geniv;
1440	u16 icv_truncbits;
1441};
1442
1443struct xfrm_algo_auth_info {
1444	u16 icv_truncbits;
1445	u16 icv_fullbits;
1446};
1447
1448struct xfrm_algo_encr_info {
1449	char *geniv;
1450	u16 blockbits;
1451	u16 defkeybits;
1452};
1453
1454struct xfrm_algo_comp_info {
1455	u16 threshold;
1456};
1457
1458struct xfrm_algo_desc {
1459	char *name;
1460	char *compat;
1461	u8 available:1;
1462	u8 pfkey_supported:1;
1463	union {
1464		struct xfrm_algo_aead_info aead;
1465		struct xfrm_algo_auth_info auth;
1466		struct xfrm_algo_encr_info encr;
1467		struct xfrm_algo_comp_info comp;
1468	} uinfo;
1469	struct sadb_alg desc;
1470};
1471
1472/* XFRM protocol handlers.  */
1473struct xfrm4_protocol {
1474	int (*handler)(struct sk_buff *skb);
1475	int (*input_handler)(struct sk_buff *skb, int nexthdr, __be32 spi,
1476			     int encap_type);
1477	int (*cb_handler)(struct sk_buff *skb, int err);
1478	int (*err_handler)(struct sk_buff *skb, u32 info);
1479
1480	struct xfrm4_protocol __rcu *next;
1481	int priority;
1482};
1483
1484struct xfrm6_protocol {
1485	int (*handler)(struct sk_buff *skb);
1486	int (*input_handler)(struct sk_buff *skb, int nexthdr, __be32 spi,
1487			     int encap_type);
1488	int (*cb_handler)(struct sk_buff *skb, int err);
1489	int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
1490			   u8 type, u8 code, int offset, __be32 info);
1491
1492	struct xfrm6_protocol __rcu *next;
1493	int priority;
1494};
1495
1496/* XFRM tunnel handlers.  */
1497struct xfrm_tunnel {
1498	int (*handler)(struct sk_buff *skb);
1499	int (*cb_handler)(struct sk_buff *skb, int err);
1500	int (*err_handler)(struct sk_buff *skb, u32 info);
1501
1502	struct xfrm_tunnel __rcu *next;
1503	int priority;
1504};
1505
1506struct xfrm6_tunnel {
1507	int (*handler)(struct sk_buff *skb);
1508	int (*cb_handler)(struct sk_buff *skb, int err);
1509	int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
1510			   u8 type, u8 code, int offset, __be32 info);
1511	struct xfrm6_tunnel __rcu *next;
1512	int priority;
1513};
1514
1515void xfrm_init(void);
1516void xfrm4_init(void);
1517int xfrm_state_init(struct net *net);
1518void xfrm_state_fini(struct net *net);
1519void xfrm4_state_init(void);
1520void xfrm4_protocol_init(void);
1521#ifdef CONFIG_XFRM
1522int xfrm6_init(void);
1523void xfrm6_fini(void);
1524int xfrm6_state_init(void);
1525void xfrm6_state_fini(void);
1526int xfrm6_protocol_init(void);
1527void xfrm6_protocol_fini(void);
1528#else
1529static inline int xfrm6_init(void)
1530{
1531	return 0;
1532}
1533static inline void xfrm6_fini(void)
1534{
1535	;
1536}
1537#endif
1538
1539#ifdef CONFIG_XFRM_STATISTICS
1540int xfrm_proc_init(struct net *net);
1541void xfrm_proc_fini(struct net *net);
1542#endif
1543
1544int xfrm_sysctl_init(struct net *net);
1545#ifdef CONFIG_SYSCTL
1546void xfrm_sysctl_fini(struct net *net);
1547#else
1548static inline void xfrm_sysctl_fini(struct net *net)
1549{
1550}
1551#endif
1552
1553void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto,
1554			  struct xfrm_address_filter *filter);
1555int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk,
1556		    int (*func)(struct xfrm_state *, int, void*), void *);
1557void xfrm_state_walk_done(struct xfrm_state_walk *walk, struct net *net);
1558struct xfrm_state *xfrm_state_alloc(struct net *net);
1559void xfrm_state_free(struct xfrm_state *x);
1560struct xfrm_state *xfrm_state_find(const xfrm_address_t *daddr,
1561				   const xfrm_address_t *saddr,
1562				   const struct flowi *fl,
1563				   struct xfrm_tmpl *tmpl,
1564				   struct xfrm_policy *pol, int *err,
1565				   unsigned short family, u32 if_id);
1566struct xfrm_state *xfrm_stateonly_find(struct net *net, u32 mark, u32 if_id,
1567				       xfrm_address_t *daddr,
1568				       xfrm_address_t *saddr,
1569				       unsigned short family,
1570				       u8 mode, u8 proto, u32 reqid);
1571struct xfrm_state *xfrm_state_lookup_byspi(struct net *net, __be32 spi,
1572					      unsigned short family);
1573int xfrm_state_check_expire(struct xfrm_state *x);
1574#ifdef CONFIG_XFRM_OFFLOAD
1575static inline void xfrm_dev_state_update_curlft(struct xfrm_state *x)
1576{
1577	struct xfrm_dev_offload *xdo = &x->xso;
1578	struct net_device *dev = xdo->dev;
1579
1580	if (x->xso.type != XFRM_DEV_OFFLOAD_PACKET)
1581		return;
1582
1583	if (dev && dev->xfrmdev_ops &&
1584	    dev->xfrmdev_ops->xdo_dev_state_update_curlft)
1585		dev->xfrmdev_ops->xdo_dev_state_update_curlft(x);
1586
1587}
1588#else
1589static inline void xfrm_dev_state_update_curlft(struct xfrm_state *x) {}
1590#endif
1591void xfrm_state_insert(struct xfrm_state *x);
1592int xfrm_state_add(struct xfrm_state *x);
1593int xfrm_state_update(struct xfrm_state *x);
1594struct xfrm_state *xfrm_state_lookup(struct net *net, u32 mark,
1595				     const xfrm_address_t *daddr, __be32 spi,
1596				     u8 proto, unsigned short family);
1597struct xfrm_state *xfrm_state_lookup_byaddr(struct net *net, u32 mark,
1598					    const xfrm_address_t *daddr,
1599					    const xfrm_address_t *saddr,
1600					    u8 proto,
1601					    unsigned short family);
1602#ifdef CONFIG_XFRM_SUB_POLICY
1603void xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n,
1604		    unsigned short family);
1605void xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n,
1606		     unsigned short family);
1607#else
1608static inline void xfrm_tmpl_sort(struct xfrm_tmpl **d, struct xfrm_tmpl **s,
1609				  int n, unsigned short family)
1610{
1611}
1612
1613static inline void xfrm_state_sort(struct xfrm_state **d, struct xfrm_state **s,
1614				   int n, unsigned short family)
1615{
1616}
1617#endif
1618
1619struct xfrmk_sadinfo {
1620	u32 sadhcnt; /* current hash bkts */
1621	u32 sadhmcnt; /* max allowed hash bkts */
1622	u32 sadcnt; /* current running count */
1623};
1624
1625struct xfrmk_spdinfo {
1626	u32 incnt;
1627	u32 outcnt;
1628	u32 fwdcnt;
1629	u32 inscnt;
1630	u32 outscnt;
1631	u32 fwdscnt;
1632	u32 spdhcnt;
1633	u32 spdhmcnt;
1634};
1635
1636struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq);
1637int xfrm_state_delete(struct xfrm_state *x);
1638int xfrm_state_flush(struct net *net, u8 proto, bool task_valid, bool sync);
1639int xfrm_dev_state_flush(struct net *net, struct net_device *dev, bool task_valid);
1640int xfrm_dev_policy_flush(struct net *net, struct net_device *dev,
1641			  bool task_valid);
1642void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si);
1643void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si);
1644u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq);
1645int xfrm_init_replay(struct xfrm_state *x, struct netlink_ext_ack *extack);
1646u32 xfrm_state_mtu(struct xfrm_state *x, int mtu);
1647int __xfrm_init_state(struct xfrm_state *x, bool init_replay, bool offload,
1648		      struct netlink_ext_ack *extack);
1649int xfrm_init_state(struct xfrm_state *x);
1650int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type);
1651int xfrm_input_resume(struct sk_buff *skb, int nexthdr);
1652int xfrm_trans_queue_net(struct net *net, struct sk_buff *skb,
1653			 int (*finish)(struct net *, struct sock *,
1654				       struct sk_buff *));
1655int xfrm_trans_queue(struct sk_buff *skb,
1656		     int (*finish)(struct net *, struct sock *,
1657				   struct sk_buff *));
1658int xfrm_output_resume(struct sock *sk, struct sk_buff *skb, int err);
1659int xfrm_output(struct sock *sk, struct sk_buff *skb);
1660
1661#if IS_ENABLED(CONFIG_NET_PKTGEN)
1662int pktgen_xfrm_outer_mode_output(struct xfrm_state *x, struct sk_buff *skb);
1663#endif
1664
1665void xfrm_local_error(struct sk_buff *skb, int mtu);
1666int xfrm4_extract_input(struct xfrm_state *x, struct sk_buff *skb);
1667int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi,
1668		    int encap_type);
1669int xfrm4_transport_finish(struct sk_buff *skb, int async);
1670int xfrm4_rcv(struct sk_buff *skb);
 
1671
1672static inline int xfrm4_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi)
1673{
1674	XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL;
1675	XFRM_SPI_SKB_CB(skb)->family = AF_INET;
1676	XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr);
1677	return xfrm_input(skb, nexthdr, spi, 0);
1678}
1679
1680int xfrm4_output(struct net *net, struct sock *sk, struct sk_buff *skb);
 
1681int xfrm4_protocol_register(struct xfrm4_protocol *handler, unsigned char protocol);
1682int xfrm4_protocol_deregister(struct xfrm4_protocol *handler, unsigned char protocol);
1683int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family);
1684int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family);
1685void xfrm4_local_error(struct sk_buff *skb, u32 mtu);
1686int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb);
1687int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi,
1688		  struct ip6_tnl *t);
1689int xfrm6_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi,
1690		    int encap_type);
1691int xfrm6_transport_finish(struct sk_buff *skb, int async);
1692int xfrm6_rcv_tnl(struct sk_buff *skb, struct ip6_tnl *t);
1693int xfrm6_rcv(struct sk_buff *skb);
1694int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
1695		     xfrm_address_t *saddr, u8 proto);
1696void xfrm6_local_error(struct sk_buff *skb, u32 mtu);
1697int xfrm6_protocol_register(struct xfrm6_protocol *handler, unsigned char protocol);
1698int xfrm6_protocol_deregister(struct xfrm6_protocol *handler, unsigned char protocol);
1699int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family);
1700int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family);
1701__be32 xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr);
1702__be32 xfrm6_tunnel_spi_lookup(struct net *net, const xfrm_address_t *saddr);
1703int xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb);
 
 
 
1704
1705#ifdef CONFIG_XFRM
1706void xfrm6_local_rxpmtu(struct sk_buff *skb, u32 mtu);
1707int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb);
1708int xfrm6_udp_encap_rcv(struct sock *sk, struct sk_buff *skb);
1709int xfrm_user_policy(struct sock *sk, int optname, sockptr_t optval,
1710		     int optlen);
1711#else
1712static inline int xfrm_user_policy(struct sock *sk, int optname,
1713				   sockptr_t optval, int optlen)
1714{
1715 	return -ENOPROTOOPT;
1716}
1717#endif
1718
1719struct dst_entry *__xfrm_dst_lookup(struct net *net, int tos, int oif,
1720				    const xfrm_address_t *saddr,
1721				    const xfrm_address_t *daddr,
1722				    int family, u32 mark);
1723
1724struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp);
1725
1726void xfrm_policy_walk_init(struct xfrm_policy_walk *walk, u8 type);
1727int xfrm_policy_walk(struct net *net, struct xfrm_policy_walk *walk,
1728		     int (*func)(struct xfrm_policy *, int, int, void*),
1729		     void *);
1730void xfrm_policy_walk_done(struct xfrm_policy_walk *walk, struct net *net);
1731int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl);
1732struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net,
1733					  const struct xfrm_mark *mark,
1734					  u32 if_id, u8 type, int dir,
1735					  struct xfrm_selector *sel,
1736					  struct xfrm_sec_ctx *ctx, int delete,
1737					  int *err);
1738struct xfrm_policy *xfrm_policy_byid(struct net *net,
1739				     const struct xfrm_mark *mark, u32 if_id,
1740				     u8 type, int dir, u32 id, int delete,
1741				     int *err);
1742int xfrm_policy_flush(struct net *net, u8 type, bool task_valid);
1743void xfrm_policy_hash_rebuild(struct net *net);
1744u32 xfrm_get_acqseq(void);
1745int verify_spi_info(u8 proto, u32 min, u32 max, struct netlink_ext_ack *extack);
1746int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi,
1747		   struct netlink_ext_ack *extack);
1748struct xfrm_state *xfrm_find_acq(struct net *net, const struct xfrm_mark *mark,
1749				 u8 mode, u32 reqid, u32 if_id, u8 proto,
1750				 const xfrm_address_t *daddr,
1751				 const xfrm_address_t *saddr, int create,
1752				 unsigned short family);
1753int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol);
1754
1755#ifdef CONFIG_XFRM_MIGRATE
1756int km_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
1757	       const struct xfrm_migrate *m, int num_bundles,
1758	       const struct xfrm_kmaddress *k,
1759	       const struct xfrm_encap_tmpl *encap);
1760struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net,
1761						u32 if_id);
1762struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x,
1763				      struct xfrm_migrate *m,
1764				      struct xfrm_encap_tmpl *encap);
1765int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
1766		 struct xfrm_migrate *m, int num_bundles,
1767		 struct xfrm_kmaddress *k, struct net *net,
1768		 struct xfrm_encap_tmpl *encap, u32 if_id,
1769		 struct netlink_ext_ack *extack);
1770#endif
1771
1772int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
1773void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 portid);
1774int km_report(struct net *net, u8 proto, struct xfrm_selector *sel,
1775	      xfrm_address_t *addr);
1776
1777void xfrm_input_init(void);
1778int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq);
1779
1780void xfrm_probe_algs(void);
1781int xfrm_count_pfkey_auth_supported(void);
1782int xfrm_count_pfkey_enc_supported(void);
1783struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx);
1784struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx);
1785struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id);
1786struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id);
1787struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id);
1788struct xfrm_algo_desc *xfrm_aalg_get_byname(const char *name, int probe);
1789struct xfrm_algo_desc *xfrm_ealg_get_byname(const char *name, int probe);
1790struct xfrm_algo_desc *xfrm_calg_get_byname(const char *name, int probe);
1791struct xfrm_algo_desc *xfrm_aead_get_byname(const char *name, int icv_len,
1792					    int probe);
1793
1794static inline bool xfrm6_addr_equal(const xfrm_address_t *a,
1795				    const xfrm_address_t *b)
1796{
1797	return ipv6_addr_equal((const struct in6_addr *)a,
1798			       (const struct in6_addr *)b);
1799}
1800
1801static inline bool xfrm_addr_equal(const xfrm_address_t *a,
1802				   const xfrm_address_t *b,
1803				   sa_family_t family)
1804{
1805	switch (family) {
1806	default:
1807	case AF_INET:
1808		return ((__force u32)a->a4 ^ (__force u32)b->a4) == 0;
1809	case AF_INET6:
1810		return xfrm6_addr_equal(a, b);
1811	}
1812}
1813
1814static inline int xfrm_policy_id2dir(u32 index)
1815{
1816	return index & 7;
1817}
1818
1819#ifdef CONFIG_XFRM
1820void xfrm_replay_advance(struct xfrm_state *x, __be32 net_seq);
1821int xfrm_replay_check(struct xfrm_state *x, struct sk_buff *skb, __be32 net_seq);
1822void xfrm_replay_notify(struct xfrm_state *x, int event);
1823int xfrm_replay_overflow(struct xfrm_state *x, struct sk_buff *skb);
1824int xfrm_replay_recheck(struct xfrm_state *x, struct sk_buff *skb, __be32 net_seq);
1825
1826static inline int xfrm_aevent_is_on(struct net *net)
1827{
1828	struct sock *nlsk;
1829	int ret = 0;
1830
1831	rcu_read_lock();
1832	nlsk = rcu_dereference(net->xfrm.nlsk);
1833	if (nlsk)
1834		ret = netlink_has_listeners(nlsk, XFRMNLGRP_AEVENTS);
1835	rcu_read_unlock();
1836	return ret;
1837}
1838
1839static inline int xfrm_acquire_is_on(struct net *net)
1840{
1841	struct sock *nlsk;
1842	int ret = 0;
1843
1844	rcu_read_lock();
1845	nlsk = rcu_dereference(net->xfrm.nlsk);
1846	if (nlsk)
1847		ret = netlink_has_listeners(nlsk, XFRMNLGRP_ACQUIRE);
1848	rcu_read_unlock();
1849
1850	return ret;
1851}
1852#endif
1853
1854static inline unsigned int aead_len(struct xfrm_algo_aead *alg)
1855{
1856	return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1857}
1858
1859static inline unsigned int xfrm_alg_len(const struct xfrm_algo *alg)
1860{
1861	return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1862}
1863
1864static inline unsigned int xfrm_alg_auth_len(const struct xfrm_algo_auth *alg)
1865{
1866	return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1867}
1868
1869static inline unsigned int xfrm_replay_state_esn_len(struct xfrm_replay_state_esn *replay_esn)
1870{
1871	return sizeof(*replay_esn) + replay_esn->bmp_len * sizeof(__u32);
1872}
1873
1874#ifdef CONFIG_XFRM_MIGRATE
1875static inline int xfrm_replay_clone(struct xfrm_state *x,
1876				     struct xfrm_state *orig)
1877{
1878
1879	x->replay_esn = kmemdup(orig->replay_esn,
1880				xfrm_replay_state_esn_len(orig->replay_esn),
1881				GFP_KERNEL);
1882	if (!x->replay_esn)
1883		return -ENOMEM;
1884	x->preplay_esn = kmemdup(orig->preplay_esn,
1885				 xfrm_replay_state_esn_len(orig->preplay_esn),
1886				 GFP_KERNEL);
1887	if (!x->preplay_esn)
1888		return -ENOMEM;
1889
1890	return 0;
1891}
1892
1893static inline struct xfrm_algo_aead *xfrm_algo_aead_clone(struct xfrm_algo_aead *orig)
1894{
1895	return kmemdup(orig, aead_len(orig), GFP_KERNEL);
1896}
1897
1898
1899static inline struct xfrm_algo *xfrm_algo_clone(struct xfrm_algo *orig)
1900{
1901	return kmemdup(orig, xfrm_alg_len(orig), GFP_KERNEL);
1902}
1903
1904static inline struct xfrm_algo_auth *xfrm_algo_auth_clone(struct xfrm_algo_auth *orig)
1905{
1906	return kmemdup(orig, xfrm_alg_auth_len(orig), GFP_KERNEL);
1907}
1908
1909static inline void xfrm_states_put(struct xfrm_state **states, int n)
1910{
1911	int i;
1912	for (i = 0; i < n; i++)
1913		xfrm_state_put(*(states + i));
1914}
1915
1916static inline void xfrm_states_delete(struct xfrm_state **states, int n)
1917{
1918	int i;
1919	for (i = 0; i < n; i++)
1920		xfrm_state_delete(*(states + i));
1921}
1922#endif
1923
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1924void __init xfrm_dev_init(void);
1925
1926#ifdef CONFIG_XFRM_OFFLOAD
1927void xfrm_dev_resume(struct sk_buff *skb);
1928void xfrm_dev_backlog(struct softnet_data *sd);
1929struct sk_buff *validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t features, bool *again);
1930int xfrm_dev_state_add(struct net *net, struct xfrm_state *x,
1931		       struct xfrm_user_offload *xuo,
1932		       struct netlink_ext_ack *extack);
1933int xfrm_dev_policy_add(struct net *net, struct xfrm_policy *xp,
1934			struct xfrm_user_offload *xuo, u8 dir,
1935			struct netlink_ext_ack *extack);
1936bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x);
1937
1938static inline void xfrm_dev_state_advance_esn(struct xfrm_state *x)
1939{
1940	struct xfrm_dev_offload *xso = &x->xso;
1941
1942	if (xso->dev && xso->dev->xfrmdev_ops->xdo_dev_state_advance_esn)
1943		xso->dev->xfrmdev_ops->xdo_dev_state_advance_esn(x);
1944}
1945
1946static inline bool xfrm_dst_offload_ok(struct dst_entry *dst)
1947{
1948	struct xfrm_state *x = dst->xfrm;
1949	struct xfrm_dst *xdst;
1950
1951	if (!x || !x->type_offload)
1952		return false;
1953
1954	xdst = (struct xfrm_dst *) dst;
1955	if (!x->xso.offload_handle && !xdst->child->xfrm)
1956		return true;
1957	if (x->xso.offload_handle && (x->xso.dev == xfrm_dst_path(dst)->dev) &&
1958	    !xdst->child->xfrm)
1959		return true;
1960
1961	return false;
1962}
1963
1964static inline void xfrm_dev_state_delete(struct xfrm_state *x)
1965{
1966	struct xfrm_dev_offload *xso = &x->xso;
1967
1968	if (xso->dev)
1969		xso->dev->xfrmdev_ops->xdo_dev_state_delete(x);
1970}
1971
1972static inline void xfrm_dev_state_free(struct xfrm_state *x)
1973{
1974	struct xfrm_dev_offload *xso = &x->xso;
1975	struct net_device *dev = xso->dev;
1976
1977	if (dev && dev->xfrmdev_ops) {
1978		if (dev->xfrmdev_ops->xdo_dev_state_free)
1979			dev->xfrmdev_ops->xdo_dev_state_free(x);
1980		xso->dev = NULL;
1981		netdev_put(dev, &xso->dev_tracker);
1982	}
1983}
1984
1985static inline void xfrm_dev_policy_delete(struct xfrm_policy *x)
1986{
1987	struct xfrm_dev_offload *xdo = &x->xdo;
1988	struct net_device *dev = xdo->dev;
1989
1990	if (dev && dev->xfrmdev_ops && dev->xfrmdev_ops->xdo_dev_policy_delete)
1991		dev->xfrmdev_ops->xdo_dev_policy_delete(x);
1992}
1993
1994static inline void xfrm_dev_policy_free(struct xfrm_policy *x)
1995{
1996	struct xfrm_dev_offload *xdo = &x->xdo;
1997	struct net_device *dev = xdo->dev;
1998
1999	if (dev && dev->xfrmdev_ops) {
2000		if (dev->xfrmdev_ops->xdo_dev_policy_free)
2001			dev->xfrmdev_ops->xdo_dev_policy_free(x);
2002		xdo->dev = NULL;
2003		netdev_put(dev, &xdo->dev_tracker);
2004	}
2005}
2006#else
2007static inline void xfrm_dev_resume(struct sk_buff *skb)
2008{
2009}
2010
2011static inline void xfrm_dev_backlog(struct softnet_data *sd)
2012{
2013}
2014
2015static inline struct sk_buff *validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t features, bool *again)
2016{
2017	return skb;
2018}
2019
2020static inline int xfrm_dev_state_add(struct net *net, struct xfrm_state *x, struct xfrm_user_offload *xuo, struct netlink_ext_ack *extack)
2021{
2022	return 0;
2023}
2024
2025static inline void xfrm_dev_state_delete(struct xfrm_state *x)
2026{
2027}
2028
2029static inline void xfrm_dev_state_free(struct xfrm_state *x)
2030{
2031}
2032
2033static inline int xfrm_dev_policy_add(struct net *net, struct xfrm_policy *xp,
2034				      struct xfrm_user_offload *xuo, u8 dir,
2035				      struct netlink_ext_ack *extack)
2036{
2037	return 0;
2038}
2039
2040static inline void xfrm_dev_policy_delete(struct xfrm_policy *x)
2041{
2042}
2043
2044static inline void xfrm_dev_policy_free(struct xfrm_policy *x)
2045{
2046}
2047
2048static inline bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x)
2049{
2050	return false;
2051}
2052
2053static inline void xfrm_dev_state_advance_esn(struct xfrm_state *x)
2054{
2055}
2056
2057static inline bool xfrm_dst_offload_ok(struct dst_entry *dst)
2058{
2059	return false;
2060}
2061#endif
2062
2063static inline int xfrm_mark_get(struct nlattr **attrs, struct xfrm_mark *m)
2064{
2065	if (attrs[XFRMA_MARK])
2066		memcpy(m, nla_data(attrs[XFRMA_MARK]), sizeof(struct xfrm_mark));
2067	else
2068		m->v = m->m = 0;
2069
2070	return m->v & m->m;
2071}
2072
2073static inline int xfrm_mark_put(struct sk_buff *skb, const struct xfrm_mark *m)
2074{
2075	int ret = 0;
2076
2077	if (m->m | m->v)
2078		ret = nla_put(skb, XFRMA_MARK, sizeof(struct xfrm_mark), m);
2079	return ret;
2080}
2081
2082static inline __u32 xfrm_smark_get(__u32 mark, struct xfrm_state *x)
2083{
2084	struct xfrm_mark *m = &x->props.smark;
2085
2086	return (m->v & m->m) | (mark & ~m->m);
2087}
2088
2089static inline int xfrm_if_id_put(struct sk_buff *skb, __u32 if_id)
2090{
2091	int ret = 0;
2092
2093	if (if_id)
2094		ret = nla_put_u32(skb, XFRMA_IF_ID, if_id);
2095	return ret;
2096}
2097
2098static inline int xfrm_tunnel_check(struct sk_buff *skb, struct xfrm_state *x,
2099				    unsigned int family)
2100{
2101	bool tunnel = false;
2102
2103	switch(family) {
2104	case AF_INET:
2105		if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4)
2106			tunnel = true;
2107		break;
2108	case AF_INET6:
2109		if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6)
2110			tunnel = true;
2111		break;
2112	}
2113	if (tunnel && !(x->outer_mode.flags & XFRM_MODE_FLAG_TUNNEL))
2114		return -EINVAL;
2115
2116	return 0;
2117}
2118
2119extern const int xfrm_msg_min[XFRM_NR_MSGTYPES];
2120extern const struct nla_policy xfrma_policy[XFRMA_MAX+1];
2121
2122struct xfrm_translator {
2123	/* Allocate frag_list and put compat translation there */
2124	int (*alloc_compat)(struct sk_buff *skb, const struct nlmsghdr *src);
2125
2126	/* Allocate nlmsg with 64-bit translaton of received 32-bit message */
2127	struct nlmsghdr *(*rcv_msg_compat)(const struct nlmsghdr *nlh,
2128			int maxtype, const struct nla_policy *policy,
2129			struct netlink_ext_ack *extack);
2130
2131	/* Translate 32-bit user_policy from sockptr */
2132	int (*xlate_user_policy_sockptr)(u8 **pdata32, int optlen);
2133
2134	struct module *owner;
2135};
2136
2137#if IS_ENABLED(CONFIG_XFRM_USER_COMPAT)
2138extern int xfrm_register_translator(struct xfrm_translator *xtr);
2139extern int xfrm_unregister_translator(struct xfrm_translator *xtr);
2140extern struct xfrm_translator *xfrm_get_translator(void);
2141extern void xfrm_put_translator(struct xfrm_translator *xtr);
2142#else
2143static inline struct xfrm_translator *xfrm_get_translator(void)
2144{
2145	return NULL;
2146}
2147static inline void xfrm_put_translator(struct xfrm_translator *xtr)
2148{
2149}
2150#endif
2151
2152#if IS_ENABLED(CONFIG_IPV6)
2153static inline bool xfrm6_local_dontfrag(const struct sock *sk)
2154{
2155	int proto;
2156
2157	if (!sk || sk->sk_family != AF_INET6)
2158		return false;
2159
2160	proto = sk->sk_protocol;
2161	if (proto == IPPROTO_UDP || proto == IPPROTO_RAW)
2162		return inet6_sk(sk)->dontfrag;
2163
2164	return false;
2165}
2166#endif
2167
2168#if (IS_BUILTIN(CONFIG_XFRM_INTERFACE) && IS_ENABLED(CONFIG_DEBUG_INFO_BTF)) || \
2169    (IS_MODULE(CONFIG_XFRM_INTERFACE) && IS_ENABLED(CONFIG_DEBUG_INFO_BTF_MODULES))
2170
2171extern struct metadata_dst __percpu *xfrm_bpf_md_dst;
2172
2173int register_xfrm_interface_bpf(void);
2174
2175#else
2176
2177static inline int register_xfrm_interface_bpf(void)
2178{
2179	return 0;
2180}
2181
2182#endif
2183
2184#endif	/* _NET_XFRM_H */