projects/linux·blob master · refs

2377 lines · 64.8 KiB

1/* SPDX-License-Identifier: GPL-2.0 */
2#ifndef _NET_XFRM_H
3#define _NET_XFRM_H
4
5#include <linux/compiler.h>
6#include <linux/xfrm.h>
7#include <linux/spinlock.h>
8#include <linux/list.h>
9#include <linux/skbuff.h>
10#include <linux/socket.h>
11#include <linux/pfkeyv2.h>
12#include <linux/ipsec.h>
13#include <linux/in6.h>
14#include <linux/mutex.h>
15#include <linux/audit.h>
16#include <linux/slab.h>
17#include <linux/refcount.h>
18#include <linux/sockptr.h>
19
20#include <net/sock.h>
21#include <net/dst.h>
22#include <net/inet_dscp.h>
23#include <net/ip.h>
24#include <net/route.h>
25#include <net/ipv6.h>
26#include <net/ip6_fib.h>
27#include <net/flow.h>
28#include <net/gro_cells.h>
29
30#include <linux/interrupt.h>
31
32#ifdef CONFIG_XFRM_STATISTICS
33#include <net/snmp.h>
34#endif
35
36#define XFRM_PROTO_ESP 50
37#define XFRM_PROTO_AH 51
38#define XFRM_PROTO_COMP 108
39#define XFRM_PROTO_IPIP 4
40#define XFRM_PROTO_IPV6 41
41#define XFRM_PROTO_IPTFS IPPROTO_AGGFRAG
42#define XFRM_PROTO_ROUTING IPPROTO_ROUTING
43#define XFRM_PROTO_DSTOPTS IPPROTO_DSTOPTS
44
45#define XFRM_ALIGN4(len) (((len) + 3) & ~3)
46#define XFRM_ALIGN8(len) (((len) + 7) & ~7)
47#define MODULE_ALIAS_XFRM_MODE(family, encap) \
48 MODULE_ALIAS("xfrm-mode-" __stringify(family) "-" __stringify(encap))
49#define MODULE_ALIAS_XFRM_TYPE(family, proto) \
50 MODULE_ALIAS("xfrm-type-" __stringify(family) "-" __stringify(proto))
51#define MODULE_ALIAS_XFRM_OFFLOAD_TYPE(family, proto) \
52 MODULE_ALIAS("xfrm-offload-" __stringify(family) "-" __stringify(proto))
53
54#ifdef CONFIG_XFRM_STATISTICS
55#define XFRM_INC_STATS(net, field) SNMP_INC_STATS((net)->mib.xfrm_statistics, field)
56#define XFRM_ADD_STATS(net, field, val) SNMP_ADD_STATS((net)->mib.xfrm_statistics, field, val)
57#else
58#define XFRM_INC_STATS(net, field) ((void)(net))
59#define XFRM_ADD_STATS(net, field, val) ((void)(net))
60#endif
61
62
63/* Organization of SPD aka "XFRM rules"
64 ------------------------------------
65
66 Basic objects:
67 - policy rule, struct xfrm_policy (=SPD entry)
68 - bundle of transformations, struct dst_entry == struct xfrm_dst (=SA bundle)
69 - instance of a transformer, struct xfrm_state (=SA)
70 - template to clone xfrm_state, struct xfrm_tmpl
71
72 SPD is organized as hash table (for policies that meet minimum address prefix
73 length setting, net->xfrm.policy_hthresh). Other policies are stored in
74 lists, sorted into rbtree ordered by destination and source address networks.
75 See net/xfrm/xfrm_policy.c for details.
76
77 (To be compatible with existing pfkeyv2 implementations,
78 many rules with priority of 0x7fffffff are allowed to exist and
79 such rules are ordered in an unpredictable way, thanks to bsd folks.)
80
81 If "action" is "block", then we prohibit the flow, otherwise:
82 if "xfrms_nr" is zero, the flow passes untransformed. Otherwise,
83 policy entry has list of up to XFRM_MAX_DEPTH transformations,
84 described by templates xfrm_tmpl. Each template is resolved
85 to a complete xfrm_state (see below) and we pack bundle of transformations
86 to a dst_entry returned to requester.
87
88 dst -. xfrm .-> xfrm_state #1
89 |---. child .-> dst -. xfrm .-> xfrm_state #2
90 |---. child .-> dst -. xfrm .-> xfrm_state #3
91 |---. child .-> NULL
92
93
94 Resolution of xrfm_tmpl
95 -----------------------
96 Template contains:
97 1. ->mode Mode: transport or tunnel
98 2. ->id.proto Protocol: AH/ESP/IPCOMP
99 3. ->id.daddr Remote tunnel endpoint, ignored for transport mode.
100 Q: allow to resolve security gateway?
101 4. ->id.spi If not zero, static SPI.
102 5. ->saddr Local tunnel endpoint, ignored for transport mode.
103 6. ->algos List of allowed algos. Plain bitmask now.
104 Q: ealgos, aalgos, calgos. What a mess...
105 7. ->share Sharing mode.
106 Q: how to implement private sharing mode? To add struct sock* to
107 flow id?
108
109 Having this template we search through SAD searching for entries
110 with appropriate mode/proto/algo, permitted by selector.
111 If no appropriate entry found, it is requested from key manager.
112
113 PROBLEMS:
114 Q: How to find all the bundles referring to a physical path for
115 PMTU discovery? Seems, dst should contain list of all parents...
116 and enter to infinite locking hierarchy disaster.
117 No! It is easier, we will not search for them, let them find us.
118 We add genid to each dst plus pointer to genid of raw IP route,
119 pmtu disc will update pmtu on raw IP route and increase its genid.
120 dst_check() will see this for top level and trigger resyncing
121 metrics. Plus, it will be made via sk->sk_dst_cache. Solved.
122 */
123
124struct xfrm_state_walk {
125 struct list_head all;
126 u8 state;
127 u8 dying;
128 u8 proto;
129 u32 seq;
130 struct xfrm_address_filter *filter;
131};
132
133enum {
134 XFRM_DEV_OFFLOAD_IN = 1,
135 XFRM_DEV_OFFLOAD_OUT,
136 XFRM_DEV_OFFLOAD_FWD,
137};
138
139enum {
140 XFRM_DEV_OFFLOAD_UNSPECIFIED,
141 XFRM_DEV_OFFLOAD_CRYPTO,
142 XFRM_DEV_OFFLOAD_PACKET,
143};
144
145enum {
146 XFRM_DEV_OFFLOAD_FLAG_ACQ = 1,
147};
148
149struct xfrm_dev_offload {
150 /* The device for this offload.
151 * Device drivers should not use this directly, as that will prevent
152 * them from working with bonding device. Instead, the device passed
153 * to the add/delete callbacks should be used.
154 */
155 struct net_device *dev;
156 netdevice_tracker dev_tracker;
157 /* This is a private pointer used by the bonding driver (and eventually
158 * should be moved there). Device drivers should not use it.
159 * Protected by xfrm_state.lock AND bond.ipsec_lock in most cases,
160 * except in the .xdo_dev_state_del() flow, where only xfrm_state.lock
161 * is held.
162 */
163 struct net_device *real_dev;
164 unsigned long offload_handle;
165 /* Snapshot the attached device index for dump paths. */
166 int ifindex;
167 u8 dir : 2;
168 u8 type : 2;
169 u8 flags : 2;
170};
171
172struct xfrm_mode {
173 u8 encap;
174 u8 family;
175 u8 flags;
176};
177
178/* Flags for xfrm_mode. */
179enum {
180 XFRM_MODE_FLAG_TUNNEL = 1,
181};
182
183enum xfrm_replay_mode {
184 XFRM_REPLAY_MODE_LEGACY,
185 XFRM_REPLAY_MODE_BMP,
186 XFRM_REPLAY_MODE_ESN,
187};
188
189/* Full description of state of transformer. */
190struct xfrm_state {
191 possible_net_t xs_net;
192 union {
193 struct hlist_node gclist;
194 struct hlist_node bydst;
195 };
196 union {
197 struct hlist_node dev_gclist;
198 struct hlist_node bysrc;
199 };
200 struct hlist_node byspi;
201 struct hlist_node byseq;
202 struct hlist_node state_cache;
203 struct hlist_node state_cache_input;
204
205 refcount_t refcnt;
206 spinlock_t lock;
207
208 u32 pcpu_num;
209 struct xfrm_id id;
210 struct xfrm_selector sel;
211 struct xfrm_mark mark;
212 u32 if_id;
213 u32 tfcpad;
214
215 u32 genid;
216
217 /* Key manager bits */
218 struct xfrm_state_walk km;
219
220 /* Parameters of this state. */
221 struct {
222 u32 reqid;
223 u8 mode;
224 u8 replay_window;
225 u8 aalgo, ealgo, calgo;
226 u8 flags;
227 u16 family;
228 xfrm_address_t saddr;
229 int header_len;
230 int enc_hdr_len;
231 int trailer_len;
232 u32 extra_flags;
233 struct xfrm_mark smark;
234 } props;
235
236 struct xfrm_lifetime_cfg lft;
237
238 /* Data for transformer */
239 struct xfrm_algo_auth *aalg;
240 struct xfrm_algo *ealg;
241 struct xfrm_algo *calg;
242 struct xfrm_algo_aead *aead;
243 const char *geniv;
244
245 /* mapping change rate limiting */
246 __be16 new_mapping_sport;
247 u32 new_mapping; /* seconds */
248 u32 mapping_maxage; /* seconds for input SA */
249
250 /* Data for encapsulator */
251 struct xfrm_encap_tmpl *encap;
252
253 /* NAT keepalive */
254 u32 nat_keepalive_interval; /* seconds */
255 time64_t nat_keepalive_expiration;
256
257 /* Data for care-of address */
258 xfrm_address_t *coaddr;
259
260 /* IPComp needs an IPIP tunnel for handling uncompressed packets */
261 struct xfrm_state *tunnel;
262
263 /* If a tunnel, number of users + 1 */
264 atomic_t tunnel_users;
265
266 /* State for replay detection */
267 struct xfrm_replay_state replay;
268 struct xfrm_replay_state_esn *replay_esn;
269
270 /* Replay detection state at the time we sent the last notification */
271 struct xfrm_replay_state preplay;
272 struct xfrm_replay_state_esn *preplay_esn;
273
274 /* replay detection mode */
275 enum xfrm_replay_mode repl_mode;
276 /* internal flag that only holds state for delayed aevent at the
277 * moment
278 */
279 u32 xflags;
280
281 /* Replay detection notification settings */
282 u32 replay_maxage;
283 u32 replay_maxdiff;
284
285 /* Replay detection notification timer */
286 struct timer_list rtimer;
287
288 /* Statistics */
289 struct xfrm_stats stats;
290
291 struct xfrm_lifetime_cur curlft;
292 struct hrtimer mtimer;
293
294 struct xfrm_dev_offload xso;
295
296 /* used to fix curlft->add_time when changing date */
297 long saved_tmo;
298
299 /* Last used time */
300 time64_t lastused;
301
302 struct page_frag xfrag;
303
304 /* Reference to data common to all the instances of this
305 * transformer. */
306 const struct xfrm_type *type;
307 struct xfrm_mode inner_mode;
308 struct xfrm_mode inner_mode_iaf;
309 struct xfrm_mode outer_mode;
310
311 const struct xfrm_type_offload *type_offload;
312
313 /* Security context */
314 struct xfrm_sec_ctx *security;
315
316 /* Private data of this transformer, format is opaque,
317 * interpreted by xfrm_type methods. */
318 void *data;
319 u8 dir;
320
321 const struct xfrm_mode_cbs *mode_cbs;
322 void *mode_data;
323};
324
325static inline struct net *xs_net(struct xfrm_state *x)
326{
327 return read_pnet(&x->xs_net);
328}
329
330/* xflags - make enum if more show up */
331#define XFRM_TIME_DEFER 1
332#define XFRM_SOFT_EXPIRE 2
333
334enum {
335 XFRM_STATE_VOID,
336 XFRM_STATE_ACQ,
337 XFRM_STATE_VALID,
338 XFRM_STATE_ERROR,
339 XFRM_STATE_EXPIRED,
340 XFRM_STATE_DEAD
341};
342
343/* callback structure passed from either netlink or pfkey */
344struct km_event {
345 union {
346 u32 hard;
347 u32 proto;
348 u32 byid;
349 u32 aevent;
350 u32 type;
351 } data;
352
353 u32 seq;
354 u32 portid;
355 u32 event;
356 struct net *net;
357};
358
359struct xfrm_if_decode_session_result {
360 struct net *net;
361 u32 if_id;
362};
363
364struct xfrm_if_cb {
365 bool (*decode_session)(struct sk_buff *skb,
366 unsigned short family,
367 struct xfrm_if_decode_session_result *res);
368};
369
370void xfrm_if_register_cb(const struct xfrm_if_cb *ifcb);
371void xfrm_if_unregister_cb(void);
372
373struct xfrm_dst_lookup_params {
374 struct net *net;
375 dscp_t dscp;
376 int oif;
377 xfrm_address_t *saddr;
378 xfrm_address_t *daddr;
379 u32 mark;
380 __u8 ipproto;
381 union flowi_uli uli;
382};
383
384struct net_device;
385struct xfrm_type;
386struct xfrm_dst;
387struct xfrm_policy_afinfo {
388 struct dst_ops *dst_ops;
389 struct dst_entry *(*dst_lookup)(const struct xfrm_dst_lookup_params *params);
390 int (*get_saddr)(xfrm_address_t *saddr,
391 const struct xfrm_dst_lookup_params *params);
392 int (*fill_dst)(struct xfrm_dst *xdst,
393 struct net_device *dev,
394 const struct flowi *fl);
395 struct dst_entry *(*blackhole_route)(struct net *net, struct dst_entry *orig);
396};
397
398int xfrm_policy_register_afinfo(const struct xfrm_policy_afinfo *afinfo, int family);
399void xfrm_policy_unregister_afinfo(const struct xfrm_policy_afinfo *afinfo);
400void km_policy_notify(struct xfrm_policy *xp, int dir,
401 const struct km_event *c);
402void km_state_notify(struct xfrm_state *x, const struct km_event *c);
403
404struct xfrm_tmpl;
405int km_query(struct xfrm_state *x, struct xfrm_tmpl *t,
406 struct xfrm_policy *pol);
407void km_state_expired(struct xfrm_state *x, int hard, u32 portid);
408int __xfrm_state_delete(struct xfrm_state *x);
409
410struct xfrm_state_afinfo {
411 u8 family;
412 u8 proto;
413
414 const struct xfrm_type_offload *type_offload_esp;
415
416 const struct xfrm_type *type_esp;
417 const struct xfrm_type *type_ipip;
418 const struct xfrm_type *type_ipip6;
419 const struct xfrm_type *type_comp;
420 const struct xfrm_type *type_ah;
421 const struct xfrm_type *type_routing;
422 const struct xfrm_type *type_dstopts;
423
424 int (*output)(struct net *net, struct sock *sk, struct sk_buff *skb);
425 int (*transport_finish)(struct sk_buff *skb,
426 int async);
427 void (*local_error)(struct sk_buff *skb, u32 mtu);
428};
429
430int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo);
431int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo);
432struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family);
433struct xfrm_state_afinfo *xfrm_state_afinfo_get_rcu(unsigned int family);
434
435struct xfrm_input_afinfo {
436 u8 family;
437 bool is_ipip;
438 int (*callback)(struct sk_buff *skb, u8 protocol,
439 int err);
440};
441
442int xfrm_input_register_afinfo(const struct xfrm_input_afinfo *afinfo);
443int xfrm_input_unregister_afinfo(const struct xfrm_input_afinfo *afinfo);
444
445void xfrm_flush_gc(void);
446
447struct xfrm_type {
448 struct module *owner;
449 u8 proto;
450 u8 flags;
451#define XFRM_TYPE_NON_FRAGMENT 1
452#define XFRM_TYPE_REPLAY_PROT 2
453#define XFRM_TYPE_LOCAL_COADDR 4
454#define XFRM_TYPE_REMOTE_COADDR 8
455
456 int (*init_state)(struct xfrm_state *x,
457 struct netlink_ext_ack *extack);
458 void (*destructor)(struct xfrm_state *);
459 int (*input)(struct xfrm_state *, struct sk_buff *skb);
460 int (*output)(struct xfrm_state *, struct sk_buff *pskb);
461 int (*reject)(struct xfrm_state *, struct sk_buff *,
462 const struct flowi *);
463};
464
465int xfrm_register_type(const struct xfrm_type *type, unsigned short family);
466void xfrm_unregister_type(const struct xfrm_type *type, unsigned short family);
467
468struct xfrm_type_offload {
469 struct module *owner;
470 u8 proto;
471 void (*encap)(struct xfrm_state *, struct sk_buff *pskb);
472 int (*input_tail)(struct xfrm_state *x, struct sk_buff *skb);
473 int (*xmit)(struct xfrm_state *, struct sk_buff *pskb, netdev_features_t features);
474};
475
476int xfrm_register_type_offload(const struct xfrm_type_offload *type, unsigned short family);
477void xfrm_unregister_type_offload(const struct xfrm_type_offload *type, unsigned short family);
478void xfrm_set_type_offload(struct xfrm_state *x, bool try_load);
479static inline void xfrm_unset_type_offload(struct xfrm_state *x)
480{
481 if (!x->type_offload)
482 return;
483
484 module_put(x->type_offload->owner);
485 x->type_offload = NULL;
486}
487
488/**
489 * struct xfrm_mode_cbs - XFRM mode callbacks
490 * @owner: module owner or NULL
491 * @init_state: Add/init mode specific state in `xfrm_state *x`
492 * @clone_state: Copy mode specific values from `orig` to new state `x`
493 * @destroy_state: Cleanup mode specific state from `xfrm_state *x`
494 * @user_init: Process mode specific netlink attributes from user
495 * @copy_to_user: Add netlink attributes to `attrs` based on state in `x`
496 * @sa_len: Return space required to store mode specific netlink attributes
497 * @get_inner_mtu: Return avail payload space after removing encap overhead
498 * @input: Process received packet from SA using mode
499 * @output: Output given packet using mode
500 * @prepare_output: Add mode specific encapsulation to packet in skb. On return
501 * `transport_header` should point at ESP header, `network_header` should
502 * point at outer IP header and `mac_header` should opint at the
503 * protocol/nexthdr field of the outer IP.
504 *
505 * One should examine and understand the specific uses of these callbacks in
506 * xfrm for further detail on how and when these functions are called. RTSL.
507 */
508struct xfrm_mode_cbs {
509 struct module *owner;
510 int (*init_state)(struct xfrm_state *x);
511 int (*clone_state)(struct xfrm_state *x, struct xfrm_state *orig);
512 void (*destroy_state)(struct xfrm_state *x);
513 int (*user_init)(struct net *net, struct xfrm_state *x,
514 struct nlattr **attrs,
515 struct netlink_ext_ack *extack);
516 int (*copy_to_user)(struct xfrm_state *x, struct sk_buff *skb);
517 unsigned int (*sa_len)(const struct xfrm_state *x);
518 u32 (*get_inner_mtu)(struct xfrm_state *x, int outer_mtu);
519 int (*input)(struct xfrm_state *x, struct sk_buff *skb);
520 int (*output)(struct net *net, struct sock *sk, struct sk_buff *skb);
521 int (*prepare_output)(struct xfrm_state *x, struct sk_buff *skb);
522};
523
524int xfrm_register_mode_cbs(u8 mode, const struct xfrm_mode_cbs *mode_cbs);
525void xfrm_unregister_mode_cbs(u8 mode);
526
527static inline int xfrm_af2proto(unsigned int family)
528{
529 switch(family) {
530 case AF_INET:
531 return IPPROTO_IPIP;
532 case AF_INET6:
533 return IPPROTO_IPV6;
534 default:
535 return 0;
536 }
537}
538
539static inline const struct xfrm_mode *xfrm_ip2inner_mode(struct xfrm_state *x, int ipproto)
540{
541 if ((x->sel.family != AF_UNSPEC) ||
542 (ipproto == IPPROTO_IPIP && x->props.family == AF_INET) ||
543 (ipproto == IPPROTO_IPV6 && x->props.family == AF_INET6))
544 return &x->inner_mode;
545 else
546 return &x->inner_mode_iaf;
547}
548
549struct xfrm_tmpl {
550/* id in template is interpreted as:
551 * daddr - destination of tunnel, may be zero for transport mode.
552 * spi - zero to acquire spi. Not zero if spi is static, then
553 * daddr must be fixed too.
554 * proto - AH/ESP/IPCOMP
555 */
556 struct xfrm_id id;
557
558/* Source address of tunnel. Ignored, if it is not a tunnel. */
559 xfrm_address_t saddr;
560
561 unsigned short encap_family;
562
563 u32 reqid;
564
565/* Mode: transport, tunnel etc. */
566 u8 mode;
567
568/* Sharing mode: unique, this session only, this user only etc. */
569 u8 share;
570
571/* May skip this transfomration if no SA is found */
572 u8 optional;
573
574/* Skip aalgos/ealgos/calgos checks. */
575 u8 allalgs;
576
577/* Bit mask of algos allowed for acquisition */
578 u32 aalgos;
579 u32 ealgos;
580 u32 calgos;
581};
582
583#define XFRM_MAX_DEPTH 6
584#define XFRM_MAX_OFFLOAD_DEPTH 1
585
586struct xfrm_policy_walk_entry {
587 struct list_head all;
588 u8 dead;
589};
590
591struct xfrm_policy_walk {
592 struct xfrm_policy_walk_entry walk;
593 u8 type;
594 u32 seq;
595};
596
597struct xfrm_policy_queue {
598 struct sk_buff_head hold_queue;
599 struct timer_list hold_timer;
600 unsigned long timeout;
601};
602
603/**
604 * struct xfrm_policy - xfrm policy
605 * @xp_net: network namespace the policy lives in
606 * @bydst: hlist node for SPD hash table or rbtree list
607 * @byidx: hlist node for index hash table
608 * @state_cache_list: hlist head for policy cached xfrm states
609 * @lock: serialize changes to policy structure members
610 * @refcnt: reference count, freed once it reaches 0
611 * @pos: kernel internal tie-breaker to determine age of policy
612 * @timer: timer
613 * @genid: generation, used to invalidate old policies
614 * @priority: priority, set by userspace
615 * @index: policy index (autogenerated)
616 * @if_id: virtual xfrm interface id
617 * @mark: packet mark
618 * @selector: selector
619 * @lft: liftime configuration data
620 * @curlft: liftime state
621 * @walk: list head on pernet policy list
622 * @polq: queue to hold packets while aqcuire operaion in progress
623 * @bydst_reinsert: policy tree node needs to be merged
624 * @type: XFRM_POLICY_TYPE_MAIN or _SUB
625 * @action: XFRM_POLICY_ALLOW or _BLOCK
626 * @flags: XFRM_POLICY_LOCALOK, XFRM_POLICY_ICMP
627 * @xfrm_nr: number of used templates in @xfrm_vec
628 * @family: protocol family
629 * @security: SELinux security label
630 * @xfrm_vec: array of templates to resolve state
631 * @rcu: rcu head, used to defer memory release
632 * @xdo: hardware offload state
633 */
634struct xfrm_policy {
635 possible_net_t xp_net;
636 struct hlist_node bydst;
637 struct hlist_node byidx;
638
639 struct hlist_head state_cache_list;
640
641 /* This lock only affects elements except for entry. */
642 rwlock_t lock;
643 refcount_t refcnt;
644 u32 pos;
645 struct timer_list timer;
646
647 atomic_t genid;
648 u32 priority;
649 u32 index;
650 u32 if_id;
651 struct xfrm_mark mark;
652 struct xfrm_selector selector;
653 struct xfrm_lifetime_cfg lft;
654 struct xfrm_lifetime_cur curlft;
655 struct xfrm_policy_walk_entry walk;
656 struct xfrm_policy_queue polq;
657 bool bydst_reinsert;
658 u8 type;
659 u8 action;
660 u8 flags;
661 u8 xfrm_nr;
662 u16 family;
663 struct xfrm_sec_ctx *security;
664 struct xfrm_tmpl xfrm_vec[XFRM_MAX_DEPTH];
665 struct rcu_head rcu;
666
667 struct xfrm_dev_offload xdo;
668};
669
670static inline struct net *xp_net(const struct xfrm_policy *xp)
671{
672 return read_pnet(&xp->xp_net);
673}
674
675struct xfrm_kmaddress {
676 xfrm_address_t local;
677 xfrm_address_t remote;
678 u32 reserved;
679 u16 family;
680};
681
682struct xfrm_migrate {
683 xfrm_address_t old_daddr;
684 xfrm_address_t old_saddr;
685 xfrm_address_t new_daddr;
686 xfrm_address_t new_saddr;
687 struct xfrm_encap_tmpl *encap;
688 struct xfrm_user_offload *xuo;
689 struct xfrm_mark old_mark;
690 const struct xfrm_mark *new_mark;
691 struct xfrm_mark smark;
692 u8 proto;
693 u8 mode;
694 u16 msg_type; /* XFRM_MSG_MIGRATE or XFRM_MSG_MIGRATE_STATE */
695 u32 flags;
696 u32 old_reqid;
697 u32 new_reqid;
698 u32 nat_keepalive_interval;
699 u32 mapping_maxage;
700 u16 old_family;
701 u16 new_family;
702 const struct xfrm_selector *new_sel;
703};
704
705#define XFRM_KM_TIMEOUT 30
706/* what happened */
707#define XFRM_REPLAY_UPDATE XFRM_AE_CR
708#define XFRM_REPLAY_TIMEOUT XFRM_AE_CE
709
710/* default aevent timeout in units of 100ms */
711#define XFRM_AE_ETIME 10
712/* Async Event timer multiplier */
713#define XFRM_AE_ETH_M 10
714/* default seq threshold size */
715#define XFRM_AE_SEQT_SIZE 2
716
717struct xfrm_mgr {
718 struct list_head list;
719 int (*notify)(struct xfrm_state *x, const struct km_event *c);
720 int (*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp);
721 struct xfrm_policy *(*compile_policy)(struct sock *sk, int opt, u8 *data, int len, int *dir);
722 int (*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
723 int (*notify_policy)(struct xfrm_policy *x, int dir, const struct km_event *c);
724 int (*report)(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr);
725 int (*migrate)(const struct xfrm_selector *sel,
726 u8 dir, u8 type,
727 const struct xfrm_migrate *m,
728 int num_bundles,
729 const struct xfrm_kmaddress *k,
730 struct net *net,
731 const struct xfrm_encap_tmpl *encap);
732 bool (*is_alive)(const struct km_event *c);
733};
734
735void xfrm_register_km(struct xfrm_mgr *km);
736void xfrm_unregister_km(struct xfrm_mgr *km);
737
738struct xfrm_tunnel_skb_cb {
739 union {
740 struct inet_skb_parm h4;
741 struct inet6_skb_parm h6;
742 } header;
743
744 union {
745 struct ip_tunnel *ip4;
746 struct ip6_tnl *ip6;
747 } tunnel;
748};
749
750#define XFRM_TUNNEL_SKB_CB(__skb) ((struct xfrm_tunnel_skb_cb *)&((__skb)->cb[0]))
751
752/*
753 * This structure is used for the duration where packets are being
754 * transformed by IPsec. As soon as the packet leaves IPsec the
755 * area beyond the generic IP part may be overwritten.
756 */
757struct xfrm_skb_cb {
758 struct xfrm_tunnel_skb_cb header;
759
760 /* Sequence number for replay protection. */
761 union {
762 struct {
763 __u32 low;
764 __u32 hi;
765 } output;
766 struct {
767 __be32 low;
768 __be32 hi;
769 } input;
770 } seq;
771};
772
773#define XFRM_SKB_CB(__skb) ((struct xfrm_skb_cb *)&((__skb)->cb[0]))
774
775/*
776 * This structure is used by the afinfo prepare_input/prepare_output functions
777 * to transmit header information to the mode input/output functions.
778 */
779struct xfrm_mode_skb_cb {
780 struct xfrm_tunnel_skb_cb header;
781
782 /* Copied from header for IPv4, always set to zero and DF for IPv6. */
783 __be16 id;
784 __be16 frag_off;
785
786 /* IP header length (excluding options or extension headers). */
787 u8 ihl;
788
789 /* TOS for IPv4, class for IPv6. */
790 u8 tos;
791
792 /* TTL for IPv4, hop limitfor IPv6. */
793 u8 ttl;
794
795 /* Protocol for IPv4, NH for IPv6. */
796 u8 protocol;
797
798 /* Option length for IPv4, zero for IPv6. */
799 u8 optlen;
800
801 /* Used by IPv6 only, zero for IPv4. */
802 u8 flow_lbl[3];
803};
804
805#define XFRM_MODE_SKB_CB(__skb) ((struct xfrm_mode_skb_cb *)&((__skb)->cb[0]))
806
807/*
808 * This structure is used by the input processing to locate the SPI and
809 * related information.
810 */
811struct xfrm_spi_skb_cb {
812 struct xfrm_tunnel_skb_cb header;
813
814 unsigned int daddroff;
815 unsigned int family;
816 __be32 seq;
817};
818
819#define XFRM_SPI_SKB_CB(__skb) ((struct xfrm_spi_skb_cb *)&((__skb)->cb[0]))
820
821#ifdef CONFIG_AUDITSYSCALL
822static inline struct audit_buffer *xfrm_audit_start(const char *op)
823{
824 struct audit_buffer *audit_buf = NULL;
825
826 if (audit_enabled == AUDIT_OFF)
827 return NULL;
828 audit_buf = audit_log_start(audit_context(), GFP_ATOMIC,
829 AUDIT_MAC_IPSEC_EVENT);
830 if (audit_buf == NULL)
831 return NULL;
832 audit_log_format(audit_buf, "op=%s", op);
833 return audit_buf;
834}
835
836static inline void xfrm_audit_helper_usrinfo(bool task_valid,
837 struct audit_buffer *audit_buf)
838{
839 const unsigned int auid = from_kuid(&init_user_ns, task_valid ?
840 audit_get_loginuid(current) :
841 INVALID_UID);
842 const unsigned int ses = task_valid ? audit_get_sessionid(current) :
843 AUDIT_SID_UNSET;
844
845 audit_log_format(audit_buf, " auid=%u ses=%u", auid, ses);
846 audit_log_task_context(audit_buf);
847}
848
849void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, bool task_valid);
850void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
851 bool task_valid);
852void xfrm_audit_state_add(struct xfrm_state *x, int result, bool task_valid);
853void xfrm_audit_state_delete(struct xfrm_state *x, int result, bool task_valid);
854void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
855 struct sk_buff *skb);
856void xfrm_audit_state_replay(struct xfrm_state *x, struct sk_buff *skb,
857 __be32 net_seq);
858void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family);
859void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, __be32 net_spi,
860 __be32 net_seq);
861void xfrm_audit_state_icvfail(struct xfrm_state *x, struct sk_buff *skb,
862 u8 proto);
863#else
864
865static inline void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
866 bool task_valid)
867{
868}
869
870static inline void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
871 bool task_valid)
872{
873}
874
875static inline void xfrm_audit_state_add(struct xfrm_state *x, int result,
876 bool task_valid)
877{
878}
879
880static inline void xfrm_audit_state_delete(struct xfrm_state *x, int result,
881 bool task_valid)
882{
883}
884
885static inline void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
886 struct sk_buff *skb)
887{
888}
889
890static inline void xfrm_audit_state_replay(struct xfrm_state *x,
891 struct sk_buff *skb, __be32 net_seq)
892{
893}
894
895static inline void xfrm_audit_state_notfound_simple(struct sk_buff *skb,
896 u16 family)
897{
898}
899
900static inline void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
901 __be32 net_spi, __be32 net_seq)
902{
903}
904
905static inline void xfrm_audit_state_icvfail(struct xfrm_state *x,
906 struct sk_buff *skb, u8 proto)
907{
908}
909#endif /* CONFIG_AUDITSYSCALL */
910
911static inline void xfrm_pol_hold(struct xfrm_policy *policy)
912{
913 if (likely(policy != NULL))
914 refcount_inc(&policy->refcnt);
915}
916
917void xfrm_policy_destroy(struct xfrm_policy *policy);
918
919static inline void xfrm_pol_put(struct xfrm_policy *policy)
920{
921 if (refcount_dec_and_test(&policy->refcnt))
922 xfrm_policy_destroy(policy);
923}
924
925static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols)
926{
927 int i;
928 for (i = npols - 1; i >= 0; --i)
929 xfrm_pol_put(pols[i]);
930}
931
932void __xfrm_state_destroy(struct xfrm_state *);
933
934static inline void __xfrm_state_put(struct xfrm_state *x)
935{
936 refcount_dec(&x->refcnt);
937}
938
939static inline void xfrm_state_put(struct xfrm_state *x)
940{
941 if (refcount_dec_and_test(&x->refcnt))
942 __xfrm_state_destroy(x);
943}
944
945static inline void xfrm_state_hold(struct xfrm_state *x)
946{
947 refcount_inc(&x->refcnt);
948}
949
950static inline bool addr_match(const void *token1, const void *token2,
951 unsigned int prefixlen)
952{
953 const __be32 *a1 = token1;
954 const __be32 *a2 = token2;
955 unsigned int pdw;
956 unsigned int pbi;
957
958 if (prefixlen > 128)
959 return false;
960
961 pdw = prefixlen >> 5; /* num of whole u32 in prefix */
962 pbi = prefixlen & 0x1f; /* num of bits in incomplete u32 in prefix */
963
964 if (pdw)
965 if (memcmp(a1, a2, pdw << 2))
966 return false;
967
968 if (pbi) {
969 __be32 mask;
970
971 mask = htonl((0xffffffff) << (32 - pbi));
972
973 if ((a1[pdw] ^ a2[pdw]) & mask)
974 return false;
975 }
976
977 return true;
978}
979
980static inline bool addr4_match(__be32 a1, __be32 a2, u8 prefixlen)
981{
982 /* C99 6.5.7 (3): u32 << 32 is undefined behaviour */
983 if (sizeof(long) == 4 && prefixlen == 0)
984 return true;
985
986 if (prefixlen > 32)
987 return false;
988
989 return !((a1 ^ a2) & htonl(~0UL << (32 - prefixlen)));
990}
991
992static __inline__
993__be16 xfrm_flowi_sport(const struct flowi *fl, const union flowi_uli *uli)
994{
995 __be16 port;
996 switch(fl->flowi_proto) {
997 case IPPROTO_TCP:
998 case IPPROTO_UDP:
999 case IPPROTO_UDPLITE:
1000 case IPPROTO_SCTP:
1001 port = uli->ports.sport;
1002 break;
1003 case IPPROTO_ICMP:
1004 case IPPROTO_ICMPV6:
1005 port = htons(uli->icmpt.type);
1006 break;
1007 case IPPROTO_MH:
1008 port = htons(uli->mht.type);
1009 break;
1010 case IPPROTO_GRE:
1011 port = htons(ntohl(uli->gre_key) >> 16);
1012 break;
1013 default:
1014 port = 0; /*XXX*/
1015 }
1016 return port;
1017}
1018
1019static __inline__
1020__be16 xfrm_flowi_dport(const struct flowi *fl, const union flowi_uli *uli)
1021{
1022 __be16 port;
1023 switch(fl->flowi_proto) {
1024 case IPPROTO_TCP:
1025 case IPPROTO_UDP:
1026 case IPPROTO_UDPLITE:
1027 case IPPROTO_SCTP:
1028 port = uli->ports.dport;
1029 break;
1030 case IPPROTO_ICMP:
1031 case IPPROTO_ICMPV6:
1032 port = htons(uli->icmpt.code);
1033 break;
1034 case IPPROTO_GRE:
1035 port = htons(ntohl(uli->gre_key) & 0xffff);
1036 break;
1037 default:
1038 port = 0; /*XXX*/
1039 }
1040 return port;
1041}
1042
1043bool xfrm_selector_match(const struct xfrm_selector *sel,
1044 const struct flowi *fl, unsigned short family);
1045
1046#ifdef CONFIG_SECURITY_NETWORK_XFRM
1047/* If neither has a context --> match
1048 * Otherwise, both must have a context and the sids, doi, alg must match
1049 */
1050static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
1051{
1052 return ((!s1 && !s2) ||
1053 (s1 && s2 &&
1054 (s1->ctx_sid == s2->ctx_sid) &&
1055 (s1->ctx_doi == s2->ctx_doi) &&
1056 (s1->ctx_alg == s2->ctx_alg)));
1057}
1058#else
1059static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
1060{
1061 return true;
1062}
1063#endif
1064
1065/* A struct encoding bundle of transformations to apply to some set of flow.
1066 *
1067 * xdst->child points to the next element of bundle.
1068 * dst->xfrm points to an instanse of transformer.
1069 *
1070 * Due to unfortunate limitations of current routing cache, which we
1071 * have no time to fix, it mirrors struct rtable and bound to the same
1072 * routing key, including saddr,daddr. However, we can have many of
1073 * bundles differing by session id. All the bundles grow from a parent
1074 * policy rule.
1075 */
1076struct xfrm_dst {
1077 union {
1078 struct dst_entry dst;
1079 struct rtable rt;
1080 struct rt6_info rt6;
1081 } u;
1082 struct dst_entry *route;
1083 struct dst_entry *child;
1084 struct dst_entry *path;
1085 struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX];
1086 int num_pols, num_xfrms;
1087 u32 xfrm_genid;
1088 u32 policy_genid;
1089 u32 route_mtu_cached;
1090 u32 child_mtu_cached;
1091 u32 route_cookie;
1092 u32 path_cookie;
1093};
1094
1095static inline struct dst_entry *xfrm_dst_path(const struct dst_entry *dst)
1096{
1097#ifdef CONFIG_XFRM
1098 if (dst->xfrm || (dst->flags & DST_XFRM_QUEUE)) {
1099 const struct xfrm_dst *xdst = (const struct xfrm_dst *) dst;
1100
1101 return xdst->path;
1102 }
1103#endif
1104 return (struct dst_entry *) dst;
1105}
1106
1107static inline struct dst_entry *xfrm_dst_child(const struct dst_entry *dst)
1108{
1109#ifdef CONFIG_XFRM
1110 if (dst->xfrm || (dst->flags & DST_XFRM_QUEUE)) {
1111 struct xfrm_dst *xdst = (struct xfrm_dst *) dst;
1112 return xdst->child;
1113 }
1114#endif
1115 return NULL;
1116}
1117
1118#ifdef CONFIG_XFRM
1119static inline void xfrm_dst_set_child(struct xfrm_dst *xdst, struct dst_entry *child)
1120{
1121 xdst->child = child;
1122}
1123
1124static inline void xfrm_dst_destroy(struct xfrm_dst *xdst)
1125{
1126 xfrm_pols_put(xdst->pols, xdst->num_pols);
1127 dst_release(xdst->route);
1128 if (likely(xdst->u.dst.xfrm))
1129 xfrm_state_put(xdst->u.dst.xfrm);
1130}
1131#endif
1132
1133void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev);
1134
1135struct xfrm_if_parms {
1136 int link; /* ifindex of underlying L2 interface */
1137 u32 if_id; /* interface identifier */
1138 bool collect_md;
1139};
1140
1141struct xfrm_if {
1142 struct xfrm_if __rcu *next; /* next interface in list */
1143 struct net_device *dev; /* virtual device associated with interface */
1144 struct net *net; /* netns for packet i/o */
1145 struct xfrm_if_parms p; /* interface parms */
1146
1147 struct gro_cells gro_cells;
1148};
1149
1150struct xfrm_offload {
1151 /* Output sequence number for replay protection on offloading. */
1152 struct {
1153 __u32 low;
1154 __u32 hi;
1155 } seq;
1156
1157 __u32 flags;
1158#define SA_DELETE_REQ 1
1159#define CRYPTO_DONE 2
1160#define CRYPTO_NEXT_DONE 4
1161#define CRYPTO_FALLBACK 8
1162#define XFRM_GSO_SEGMENT 16
1163#define XFRM_GRO 32
1164/* 64 is free */
1165#define XFRM_DEV_RESUME 128
1166#define XFRM_XMIT 256
1167
1168 __u32 status;
1169#define CRYPTO_SUCCESS 1
1170#define CRYPTO_GENERIC_ERROR 2
1171#define CRYPTO_TRANSPORT_AH_AUTH_FAILED 4
1172#define CRYPTO_TRANSPORT_ESP_AUTH_FAILED 8
1173#define CRYPTO_TUNNEL_AH_AUTH_FAILED 16
1174#define CRYPTO_TUNNEL_ESP_AUTH_FAILED 32
1175#define CRYPTO_INVALID_PACKET_SYNTAX 64
1176#define CRYPTO_INVALID_PROTOCOL 128
1177
1178 /* Used to keep whole l2 header for transport mode GRO */
1179 __u16 orig_mac_len;
1180
1181 __u8 proto;
1182 __u8 inner_ipproto;
1183};
1184
1185struct sec_path {
1186 struct xfrm_state *xvec[XFRM_MAX_DEPTH];
1187 struct xfrm_offload ovec[XFRM_MAX_OFFLOAD_DEPTH];
1188
1189 u8 len;
1190 u8 olen;
1191 u8 verified_cnt;
1192};
1193
1194struct sec_path *secpath_set(struct sk_buff *skb);
1195
1196static inline void
1197secpath_reset(struct sk_buff *skb)
1198{
1199#ifdef CONFIG_XFRM
1200 skb_ext_del(skb, SKB_EXT_SEC_PATH);
1201#endif
1202}
1203
1204static inline int
1205xfrm_addr_any(const xfrm_address_t *addr, unsigned short family)
1206{
1207 switch (family) {
1208 case AF_INET:
1209 return addr->a4 == 0;
1210 case AF_INET6:
1211 return ipv6_addr_any(&addr->in6);
1212 }
1213 return 0;
1214}
1215
1216static inline int
1217__xfrm4_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x)
1218{
1219 return (tmpl->saddr.a4 &&
1220 tmpl->saddr.a4 != x->props.saddr.a4);
1221}
1222
1223static inline int
1224__xfrm6_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x)
1225{
1226 return (!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) &&
1227 !ipv6_addr_equal((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr));
1228}
1229
1230static inline int
1231xfrm_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x, unsigned short family)
1232{
1233 switch (family) {
1234 case AF_INET:
1235 return __xfrm4_state_addr_cmp(tmpl, x);
1236 case AF_INET6:
1237 return __xfrm6_state_addr_cmp(tmpl, x);
1238 }
1239 return !0;
1240}
1241
1242#ifdef CONFIG_XFRM
1243static inline struct xfrm_state *xfrm_input_state(struct sk_buff *skb)
1244{
1245 struct sec_path *sp = skb_sec_path(skb);
1246
1247 return sp->xvec[sp->len - 1];
1248}
1249#endif
1250
1251static inline struct xfrm_offload *xfrm_offload(struct sk_buff *skb)
1252{
1253#ifdef CONFIG_XFRM
1254 struct sec_path *sp = skb_sec_path(skb);
1255
1256 if (!sp || !sp->olen || sp->len != sp->olen)
1257 return NULL;
1258
1259 return &sp->ovec[sp->olen - 1];
1260#else
1261 return NULL;
1262#endif
1263}
1264
1265#ifdef CONFIG_XFRM
1266int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb,
1267 unsigned short family);
1268
1269static inline bool __xfrm_check_nopolicy(struct net *net, struct sk_buff *skb,
1270 int dir)
1271{
1272 if (!READ_ONCE(net->xfrm.policy_count[dir]) && !secpath_exists(skb))
1273 return READ_ONCE(net->xfrm.policy_default[dir]) == XFRM_USERPOLICY_ACCEPT;
1274
1275 return false;
1276}
1277
1278static inline bool __xfrm_check_dev_nopolicy(struct sk_buff *skb,
1279 int dir, unsigned short family)
1280{
1281 if (dir != XFRM_POLICY_OUT && family == AF_INET) {
1282 /* same dst may be used for traffic originating from
1283 * devices with different policy settings.
1284 */
1285 return IPCB(skb)->flags & IPSKB_NOPOLICY;
1286 }
1287 return skb_dst(skb) && (skb_dst(skb)->flags & DST_NOPOLICY);
1288}
1289
1290static inline int __xfrm_policy_check2(struct sock *sk, int dir,
1291 struct sk_buff *skb,
1292 unsigned int family, int reverse)
1293{
1294 struct net *net = dev_net(skb->dev);
1295 int ndir = dir | (reverse ? XFRM_POLICY_MASK + 1 : 0);
1296 struct xfrm_offload *xo = xfrm_offload(skb);
1297 struct xfrm_state *x;
1298
1299 if (sk && sk->sk_policy[XFRM_POLICY_IN])
1300 return __xfrm_policy_check(sk, ndir, skb, family);
1301
1302 if (xo) {
1303 x = xfrm_input_state(skb);
1304 if (x->xso.type == XFRM_DEV_OFFLOAD_PACKET) {
1305 bool check = (xo->flags & CRYPTO_DONE) &&
1306 (xo->status & CRYPTO_SUCCESS);
1307
1308 /* The packets here are plain ones and secpath was
1309 * needed to indicate that hardware already handled
1310 * them and there is no need to do nothing in addition.
1311 *
1312 * Consume secpath which was set by drivers.
1313 */
1314 secpath_reset(skb);
1315 return check;
1316 }
1317 }
1318
1319 return __xfrm_check_nopolicy(net, skb, dir) ||
1320 __xfrm_check_dev_nopolicy(skb, dir, family) ||
1321 __xfrm_policy_check(sk, ndir, skb, family);
1322}
1323
1324static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
1325{
1326 return __xfrm_policy_check2(sk, dir, skb, family, 0);
1327}
1328
1329static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1330{
1331 return xfrm_policy_check(sk, dir, skb, AF_INET);
1332}
1333
1334static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1335{
1336 return xfrm_policy_check(sk, dir, skb, AF_INET6);
1337}
1338
1339static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
1340 struct sk_buff *skb)
1341{
1342 return __xfrm_policy_check2(sk, dir, skb, AF_INET, 1);
1343}
1344
1345static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
1346 struct sk_buff *skb)
1347{
1348 return __xfrm_policy_check2(sk, dir, skb, AF_INET6, 1);
1349}
1350
1351int __xfrm_decode_session(struct net *net, struct sk_buff *skb, struct flowi *fl,
1352 unsigned int family, int reverse);
1353
1354static inline int xfrm_decode_session(struct net *net, struct sk_buff *skb, struct flowi *fl,
1355 unsigned int family)
1356{
1357 return __xfrm_decode_session(net, skb, fl, family, 0);
1358}
1359
1360static inline int xfrm_decode_session_reverse(struct net *net, struct sk_buff *skb,
1361 struct flowi *fl,
1362 unsigned int family)
1363{
1364 return __xfrm_decode_session(net, skb, fl, family, 1);
1365}
1366
1367int __xfrm_route_forward(struct sk_buff *skb, unsigned short family);
1368
1369static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family)
1370{
1371 struct net *net = dev_net(skb->dev);
1372
1373 if (!READ_ONCE(net->xfrm.policy_count[XFRM_POLICY_OUT]) &&
1374 READ_ONCE(net->xfrm.policy_default[XFRM_POLICY_OUT]) == XFRM_USERPOLICY_ACCEPT)
1375 return true;
1376
1377 return (skb_dst(skb)->flags & DST_NOXFRM) ||
1378 __xfrm_route_forward(skb, family);
1379}
1380
1381static inline int xfrm4_route_forward(struct sk_buff *skb)
1382{
1383 return xfrm_route_forward(skb, AF_INET);
1384}
1385
1386static inline int xfrm6_route_forward(struct sk_buff *skb)
1387{
1388 return xfrm_route_forward(skb, AF_INET6);
1389}
1390
1391int __xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk);
1392
1393static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk)
1394{
1395 if (!sk_fullsock(osk))
1396 return 0;
1397 sk->sk_policy[0] = NULL;
1398 sk->sk_policy[1] = NULL;
1399 if (unlikely(osk->sk_policy[0] || osk->sk_policy[1]))
1400 return __xfrm_sk_clone_policy(sk, osk);
1401 return 0;
1402}
1403
1404int xfrm_policy_delete(struct xfrm_policy *pol, int dir);
1405
1406static inline void xfrm_sk_free_policy(struct sock *sk)
1407{
1408 struct xfrm_policy *pol;
1409
1410 pol = rcu_dereference_protected(sk->sk_policy[0], 1);
1411 if (unlikely(pol != NULL)) {
1412 xfrm_policy_delete(pol, XFRM_POLICY_MAX);
1413 sk->sk_policy[0] = NULL;
1414 }
1415 pol = rcu_dereference_protected(sk->sk_policy[1], 1);
1416 if (unlikely(pol != NULL)) {
1417 xfrm_policy_delete(pol, XFRM_POLICY_MAX+1);
1418 sk->sk_policy[1] = NULL;
1419 }
1420}
1421
1422#else
1423
1424static inline void xfrm_sk_free_policy(struct sock *sk) {}
1425static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk) { return 0; }
1426static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; }
1427static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; }
1428static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1429{
1430 return 1;
1431}
1432static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1433{
1434 return 1;
1435}
1436static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
1437{
1438 return 1;
1439}
1440static inline int xfrm_decode_session_reverse(struct net *net, struct sk_buff *skb,
1441 struct flowi *fl,
1442 unsigned int family)
1443{
1444 return -ENOSYS;
1445}
1446static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
1447 struct sk_buff *skb)
1448{
1449 return 1;
1450}
1451static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
1452 struct sk_buff *skb)
1453{
1454 return 1;
1455}
1456#endif
1457
1458static __inline__
1459xfrm_address_t *xfrm_flowi_daddr(const struct flowi *fl, unsigned short family)
1460{
1461 switch (family){
1462 case AF_INET:
1463 return (xfrm_address_t *)&fl->u.ip4.daddr;
1464 case AF_INET6:
1465 return (xfrm_address_t *)&fl->u.ip6.daddr;
1466 }
1467 return NULL;
1468}
1469
1470static __inline__
1471xfrm_address_t *xfrm_flowi_saddr(const struct flowi *fl, unsigned short family)
1472{
1473 switch (family){
1474 case AF_INET:
1475 return (xfrm_address_t *)&fl->u.ip4.saddr;
1476 case AF_INET6:
1477 return (xfrm_address_t *)&fl->u.ip6.saddr;
1478 }
1479 return NULL;
1480}
1481
1482static __inline__
1483void xfrm_flowi_addr_get(const struct flowi *fl,
1484 xfrm_address_t *saddr, xfrm_address_t *daddr,
1485 unsigned short family)
1486{
1487 switch(family) {
1488 case AF_INET:
1489 memcpy(&saddr->a4, &fl->u.ip4.saddr, sizeof(saddr->a4));
1490 memcpy(&daddr->a4, &fl->u.ip4.daddr, sizeof(daddr->a4));
1491 break;
1492 case AF_INET6:
1493 saddr->in6 = fl->u.ip6.saddr;
1494 daddr->in6 = fl->u.ip6.daddr;
1495 break;
1496 }
1497}
1498
1499static __inline__ int
1500__xfrm4_state_addr_check(const struct xfrm_state *x,
1501 const xfrm_address_t *daddr, const xfrm_address_t *saddr)
1502{
1503 if (daddr->a4 == x->id.daddr.a4 &&
1504 (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4))
1505 return 1;
1506 return 0;
1507}
1508
1509static __inline__ int
1510__xfrm6_state_addr_check(const struct xfrm_state *x,
1511 const xfrm_address_t *daddr, const xfrm_address_t *saddr)
1512{
1513 if (ipv6_addr_equal((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) &&
1514 (ipv6_addr_equal((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr) ||
1515 ipv6_addr_any((struct in6_addr *)saddr) ||
1516 ipv6_addr_any((struct in6_addr *)&x->props.saddr)))
1517 return 1;
1518 return 0;
1519}
1520
1521static __inline__ int
1522xfrm_state_addr_check(const struct xfrm_state *x,
1523 const xfrm_address_t *daddr, const xfrm_address_t *saddr,
1524 unsigned short family)
1525{
1526 switch (family) {
1527 case AF_INET:
1528 return __xfrm4_state_addr_check(x, daddr, saddr);
1529 case AF_INET6:
1530 return __xfrm6_state_addr_check(x, daddr, saddr);
1531 }
1532 return 0;
1533}
1534
1535static __inline__ int
1536xfrm_state_addr_flow_check(const struct xfrm_state *x, const struct flowi *fl,
1537 unsigned short family)
1538{
1539 switch (family) {
1540 case AF_INET:
1541 return __xfrm4_state_addr_check(x,
1542 (const xfrm_address_t *)&fl->u.ip4.daddr,
1543 (const xfrm_address_t *)&fl->u.ip4.saddr);
1544 case AF_INET6:
1545 return __xfrm6_state_addr_check(x,
1546 (const xfrm_address_t *)&fl->u.ip6.daddr,
1547 (const xfrm_address_t *)&fl->u.ip6.saddr);
1548 }
1549 return 0;
1550}
1551
1552static inline int xfrm_state_kern(const struct xfrm_state *x)
1553{
1554 return atomic_read(&x->tunnel_users);
1555}
1556
1557static inline bool xfrm_id_proto_valid(u8 proto)
1558{
1559 switch (proto) {
1560 case IPPROTO_AH:
1561 case IPPROTO_ESP:
1562 case IPPROTO_COMP:
1563#if IS_ENABLED(CONFIG_IPV6)
1564 case IPPROTO_ROUTING:
1565 case IPPROTO_DSTOPTS:
1566#endif
1567 return true;
1568 default:
1569 return false;
1570 }
1571}
1572
1573/* IPSEC_PROTO_ANY only matches 3 IPsec protocols, 0 could match all. */
1574static inline int xfrm_id_proto_match(u8 proto, u8 userproto)
1575{
1576 return (!userproto || proto == userproto ||
1577 (userproto == IPSEC_PROTO_ANY && (proto == IPPROTO_AH ||
1578 proto == IPPROTO_ESP ||
1579 proto == IPPROTO_COMP)));
1580}
1581
1582/*
1583 * xfrm algorithm information
1584 */
1585struct xfrm_algo_aead_info {
1586 char *geniv;
1587 u16 icv_truncbits;
1588};
1589
1590struct xfrm_algo_auth_info {
1591 u16 icv_truncbits;
1592 u16 icv_fullbits;
1593};
1594
1595struct xfrm_algo_encr_info {
1596 char *geniv;
1597 u16 blockbits;
1598 u16 defkeybits;
1599};
1600
1601struct xfrm_algo_comp_info {
1602 u16 threshold;
1603};
1604
1605struct xfrm_algo_desc {
1606 char *name;
1607 char *compat;
1608 u8 available:1;
1609 u8 pfkey_supported:1;
1610 union {
1611 struct xfrm_algo_aead_info aead;
1612 struct xfrm_algo_auth_info auth;
1613 struct xfrm_algo_encr_info encr;
1614 struct xfrm_algo_comp_info comp;
1615 } uinfo;
1616 struct sadb_alg desc;
1617};
1618
1619/* XFRM protocol handlers. */
1620struct xfrm4_protocol {
1621 int (*handler)(struct sk_buff *skb);
1622 int (*input_handler)(struct sk_buff *skb, int nexthdr, __be32 spi,
1623 int encap_type);
1624 int (*cb_handler)(struct sk_buff *skb, int err);
1625 int (*err_handler)(struct sk_buff *skb, u32 info);
1626
1627 struct xfrm4_protocol __rcu *next;
1628 int priority;
1629};
1630
1631struct xfrm6_protocol {
1632 int (*handler)(struct sk_buff *skb);
1633 int (*input_handler)(struct sk_buff *skb, int nexthdr, __be32 spi,
1634 int encap_type);
1635 int (*cb_handler)(struct sk_buff *skb, int err);
1636 int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
1637 u8 type, u8 code, int offset, __be32 info);
1638
1639 struct xfrm6_protocol __rcu *next;
1640 int priority;
1641};
1642
1643/* XFRM tunnel handlers. */
1644struct xfrm_tunnel {
1645 int (*handler)(struct sk_buff *skb);
1646 int (*cb_handler)(struct sk_buff *skb, int err);
1647 int (*err_handler)(struct sk_buff *skb, u32 info);
1648
1649 struct xfrm_tunnel __rcu *next;
1650 int priority;
1651};
1652
1653struct xfrm6_tunnel {
1654 int (*handler)(struct sk_buff *skb);
1655 int (*cb_handler)(struct sk_buff *skb, int err);
1656 int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
1657 u8 type, u8 code, int offset, __be32 info);
1658 struct xfrm6_tunnel __rcu *next;
1659 int priority;
1660};
1661
1662void xfrm_init(void);
1663void xfrm4_init(void);
1664int xfrm_state_init(struct net *net);
1665void xfrm_state_fini(struct net *net);
1666void xfrm4_state_init(void);
1667void xfrm4_protocol_init(void);
1668#ifdef CONFIG_XFRM
1669int xfrm6_init(void);
1670void xfrm6_fini(void);
1671int xfrm6_state_init(void);
1672void xfrm6_state_fini(void);
1673int xfrm6_protocol_init(void);
1674void xfrm6_protocol_fini(void);
1675#else
1676static inline int xfrm6_init(void)
1677{
1678 return 0;
1679}
1680static inline void xfrm6_fini(void)
1681{
1682 ;
1683}
1684#endif
1685
1686#ifdef CONFIG_XFRM_STATISTICS
1687int xfrm_proc_init(struct net *net);
1688void xfrm_proc_fini(struct net *net);
1689#endif
1690
1691int xfrm_sysctl_init(struct net *net);
1692#ifdef CONFIG_SYSCTL
1693void xfrm_sysctl_fini(struct net *net);
1694#else
1695static inline void xfrm_sysctl_fini(struct net *net)
1696{
1697}
1698#endif
1699
1700void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto,
1701 struct xfrm_address_filter *filter);
1702int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk,
1703 int (*func)(struct xfrm_state *, int, void*), void *);
1704void xfrm_state_walk_done(struct xfrm_state_walk *walk, struct net *net);
1705struct xfrm_state *xfrm_state_alloc(struct net *net);
1706void xfrm_state_free(struct xfrm_state *x);
1707struct xfrm_state *xfrm_state_find(const xfrm_address_t *daddr,
1708 const xfrm_address_t *saddr,
1709 const struct flowi *fl,
1710 struct xfrm_tmpl *tmpl,
1711 struct xfrm_policy *pol, int *err,
1712 unsigned short family, u32 if_id);
1713struct xfrm_state *xfrm_stateonly_find(struct net *net, u32 mark, u32 if_id,
1714 xfrm_address_t *daddr,
1715 xfrm_address_t *saddr,
1716 unsigned short family,
1717 u8 mode, u8 proto, u32 reqid);
1718struct xfrm_state *xfrm_state_lookup_byspi(struct net *net, __be32 spi,
1719 unsigned short family);
1720int xfrm_state_check_expire(struct xfrm_state *x);
1721void xfrm_state_update_stats(struct net *net);
1722#ifdef CONFIG_XFRM_OFFLOAD
1723static inline void xfrm_dev_state_update_stats(struct xfrm_state *x)
1724{
1725 struct xfrm_dev_offload *xdo = &x->xso;
1726 struct net_device *dev = READ_ONCE(xdo->dev);
1727
1728 if (dev && dev->xfrmdev_ops &&
1729 dev->xfrmdev_ops->xdo_dev_state_update_stats)
1730 dev->xfrmdev_ops->xdo_dev_state_update_stats(x);
1731
1732}
1733#else
1734static inline void xfrm_dev_state_update_stats(struct xfrm_state *x) {}
1735#endif
1736void xfrm_state_insert(struct xfrm_state *x);
1737int xfrm_state_add(struct xfrm_state *x);
1738int xfrm_state_update(struct xfrm_state *x);
1739struct xfrm_state *xfrm_state_lookup(struct net *net, u32 mark,
1740 const xfrm_address_t *daddr, __be32 spi,
1741 u8 proto, unsigned short family);
1742struct xfrm_state *xfrm_input_state_lookup(struct net *net, u32 mark,
1743 const xfrm_address_t *daddr,
1744 __be32 spi, u8 proto,
1745 unsigned short family);
1746struct xfrm_state *xfrm_state_lookup_byaddr(struct net *net, u32 mark,
1747 const xfrm_address_t *daddr,
1748 const xfrm_address_t *saddr,
1749 u8 proto,
1750 unsigned short family);
1751#ifdef CONFIG_XFRM_SUB_POLICY
1752void xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n,
1753 unsigned short family);
1754void xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n,
1755 unsigned short family);
1756#else
1757static inline void xfrm_tmpl_sort(struct xfrm_tmpl **d, struct xfrm_tmpl **s,
1758 int n, unsigned short family)
1759{
1760}
1761
1762static inline void xfrm_state_sort(struct xfrm_state **d, struct xfrm_state **s,
1763 int n, unsigned short family)
1764{
1765}
1766#endif
1767
1768struct xfrmk_sadinfo {
1769 u32 sadhcnt; /* current hash bkts */
1770 u32 sadhmcnt; /* max allowed hash bkts */
1771 u32 sadcnt; /* current running count */
1772};
1773
1774struct xfrmk_spdinfo {
1775 u32 incnt;
1776 u32 outcnt;
1777 u32 fwdcnt;
1778 u32 inscnt;
1779 u32 outscnt;
1780 u32 fwdscnt;
1781 u32 spdhcnt;
1782 u32 spdhmcnt;
1783};
1784
1785struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq, u32 pcpu_num);
1786int xfrm_state_delete(struct xfrm_state *x);
1787int xfrm_state_flush(struct net *net, u8 proto, bool task_valid);
1788int xfrm_dev_state_flush(struct net *net, struct net_device *dev, bool task_valid);
1789int xfrm_dev_policy_flush(struct net *net, struct net_device *dev,
1790 bool task_valid);
1791void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si);
1792void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si);
1793u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq);
1794int xfrm_init_replay(struct xfrm_state *x, struct netlink_ext_ack *extack);
1795u32 xfrm_state_mtu(struct xfrm_state *x, int mtu);
1796int __xfrm_init_state(struct xfrm_state *x, struct netlink_ext_ack *extack);
1797int xfrm_init_state(struct xfrm_state *x, struct netlink_ext_ack *extack);
1798int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type);
1799int xfrm_input_resume(struct sk_buff *skb, int nexthdr);
1800int xfrm_trans_queue_net(struct net *net, struct sk_buff *skb,
1801 int (*finish)(struct net *, struct sock *,
1802 struct sk_buff *));
1803int xfrm_trans_queue(struct sk_buff *skb,
1804 int (*finish)(struct net *, struct sock *,
1805 struct sk_buff *));
1806int xfrm_output_resume(struct sock *sk, struct sk_buff *skb, int err);
1807int xfrm_output(struct sock *sk, struct sk_buff *skb);
1808int xfrm4_tunnel_check_size(struct sk_buff *skb);
1809#if IS_ENABLED(CONFIG_IPV6)
1810int xfrm6_tunnel_check_size(struct sk_buff *skb);
1811#else
1812static inline int xfrm6_tunnel_check_size(struct sk_buff *skb)
1813{
1814 return -EMSGSIZE;
1815}
1816#endif
1817
1818#if IS_ENABLED(CONFIG_NET_PKTGEN)
1819int pktgen_xfrm_outer_mode_output(struct xfrm_state *x, struct sk_buff *skb);
1820#endif
1821
1822void xfrm_local_error(struct sk_buff *skb, int mtu);
1823int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi,
1824 int encap_type);
1825int xfrm4_transport_finish(struct sk_buff *skb, int async);
1826int xfrm4_rcv(struct sk_buff *skb);
1827
1828static inline int xfrm4_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi)
1829{
1830 XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL;
1831 XFRM_SPI_SKB_CB(skb)->family = AF_INET;
1832 XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr);
1833 return xfrm_input(skb, nexthdr, spi, 0);
1834}
1835
1836int xfrm4_output(struct net *net, struct sock *sk, struct sk_buff *skb);
1837int xfrm4_protocol_register(struct xfrm4_protocol *handler, unsigned char protocol);
1838int xfrm4_protocol_deregister(struct xfrm4_protocol *handler, unsigned char protocol);
1839int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family);
1840int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family);
1841void xfrm4_local_error(struct sk_buff *skb, u32 mtu);
1842int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi,
1843 struct ip6_tnl *t);
1844int xfrm6_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi,
1845 int encap_type);
1846int xfrm6_transport_finish(struct sk_buff *skb, int async);
1847int xfrm6_rcv_tnl(struct sk_buff *skb, struct ip6_tnl *t);
1848int xfrm6_rcv(struct sk_buff *skb);
1849int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
1850 xfrm_address_t *saddr, u8 proto);
1851void xfrm6_local_error(struct sk_buff *skb, u32 mtu);
1852int xfrm6_protocol_register(struct xfrm6_protocol *handler, unsigned char protocol);
1853int xfrm6_protocol_deregister(struct xfrm6_protocol *handler, unsigned char protocol);
1854int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family);
1855int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family);
1856__be32 xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr);
1857__be32 xfrm6_tunnel_spi_lookup(struct net *net, const xfrm_address_t *saddr);
1858int xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb);
1859
1860#ifdef CONFIG_XFRM
1861void xfrm6_local_rxpmtu(struct sk_buff *skb, u32 mtu);
1862int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb);
1863int xfrm6_udp_encap_rcv(struct sock *sk, struct sk_buff *skb);
1864struct sk_buff *xfrm4_gro_udp_encap_rcv(struct sock *sk, struct list_head *head,
1865 struct sk_buff *skb);
1866struct sk_buff *xfrm6_gro_udp_encap_rcv(struct sock *sk, struct list_head *head,
1867 struct sk_buff *skb);
1868int xfrm_user_policy(struct sock *sk, int optname, sockptr_t optval,
1869 int optlen);
1870#else
1871static inline int xfrm_user_policy(struct sock *sk, int optname,
1872 sockptr_t optval, int optlen)
1873{
1874 return -ENOPROTOOPT;
1875}
1876#endif
1877
1878struct dst_entry *__xfrm_dst_lookup(int family, const struct xfrm_dst_lookup_params *params);
1879
1880struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp);
1881
1882void xfrm_policy_walk_init(struct xfrm_policy_walk *walk, u8 type);
1883int xfrm_policy_walk(struct net *net, struct xfrm_policy_walk *walk,
1884 int (*func)(struct xfrm_policy *, int, int, void*),
1885 void *);
1886void xfrm_policy_walk_done(struct xfrm_policy_walk *walk, struct net *net);
1887int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl);
1888struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net,
1889 const struct xfrm_mark *mark,
1890 u32 if_id, u8 type, int dir,
1891 struct xfrm_selector *sel,
1892 struct xfrm_sec_ctx *ctx, int delete,
1893 int *err);
1894struct xfrm_policy *xfrm_policy_byid(struct net *net,
1895 const struct xfrm_mark *mark, u32 if_id,
1896 u8 type, int dir, u32 id, int delete,
1897 int *err);
1898int xfrm_policy_flush(struct net *net, u8 type, bool task_valid);
1899void xfrm_policy_hash_rebuild(struct net *net);
1900u32 xfrm_get_acqseq(void);
1901int verify_spi_info(u8 proto, u32 min, u32 max, struct netlink_ext_ack *extack);
1902int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi,
1903 struct netlink_ext_ack *extack);
1904struct xfrm_state *xfrm_find_acq(struct net *net, const struct xfrm_mark *mark,
1905 u8 mode, u32 reqid, u32 if_id, u32 pcpu_num, u8 proto,
1906 const xfrm_address_t *daddr,
1907 const xfrm_address_t *saddr, int create,
1908 unsigned short family);
1909int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol);
1910
1911#ifdef CONFIG_XFRM_MIGRATE
1912int km_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
1913 const struct xfrm_migrate *m, int num_bundles,
1914 const struct xfrm_kmaddress *k, struct net *net,
1915 const struct xfrm_encap_tmpl *encap);
1916struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net,
1917 u32 if_id);
1918struct xfrm_state *xfrm_state_migrate_create(struct xfrm_state *x,
1919 const struct xfrm_migrate *m,
1920 struct net *net,
1921 struct netlink_ext_ack *extack);
1922int xfrm_state_migrate_install(const struct xfrm_state *x,
1923 struct xfrm_state *xc,
1924 const struct xfrm_migrate *m,
1925 struct netlink_ext_ack *extack);
1926struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x,
1927 struct xfrm_migrate *m,
1928 struct net *net,
1929 struct netlink_ext_ack *extack);
1930int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
1931 struct xfrm_migrate *m, int num_bundles,
1932 struct xfrm_kmaddress *k, struct net *net,
1933 struct xfrm_encap_tmpl *encap, u32 if_id,
1934 struct netlink_ext_ack *extack,
1935 struct xfrm_user_offload *xuo);
1936#endif
1937
1938int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
1939void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 portid);
1940int km_report(struct net *net, u8 proto, struct xfrm_selector *sel,
1941 xfrm_address_t *addr);
1942
1943void xfrm_input_init(void);
1944int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq);
1945
1946void xfrm_probe_algs(void);
1947int xfrm_count_pfkey_auth_supported(void);
1948int xfrm_count_pfkey_enc_supported(void);
1949struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx);
1950struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx);
1951struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id);
1952struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id);
1953struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id);
1954struct xfrm_algo_desc *xfrm_aalg_get_byname(const char *name, int probe);
1955struct xfrm_algo_desc *xfrm_ealg_get_byname(const char *name, int probe);
1956struct xfrm_algo_desc *xfrm_calg_get_byname(const char *name, int probe);
1957struct xfrm_algo_desc *xfrm_aead_get_byname(const char *name, int icv_len,
1958 int probe);
1959
1960static inline bool xfrm6_addr_equal(const xfrm_address_t *a,
1961 const xfrm_address_t *b)
1962{
1963 return ipv6_addr_equal((const struct in6_addr *)a,
1964 (const struct in6_addr *)b);
1965}
1966
1967static inline bool xfrm_addr_equal(const xfrm_address_t *a,
1968 const xfrm_address_t *b,
1969 sa_family_t family)
1970{
1971 switch (family) {
1972 default:
1973 case AF_INET:
1974 return ((__force u32)a->a4 ^ (__force u32)b->a4) == 0;
1975 case AF_INET6:
1976 return xfrm6_addr_equal(a, b);
1977 }
1978}
1979
1980static inline int xfrm_policy_id2dir(u32 index)
1981{
1982 return index & 7;
1983}
1984
1985#ifdef CONFIG_XFRM
1986void xfrm_replay_advance(struct xfrm_state *x, __be32 net_seq);
1987int xfrm_replay_check(struct xfrm_state *x, struct sk_buff *skb, __be32 net_seq);
1988void xfrm_replay_notify(struct xfrm_state *x, int event);
1989int xfrm_replay_overflow(struct xfrm_state *x, struct sk_buff *skb);
1990int xfrm_replay_recheck(struct xfrm_state *x, struct sk_buff *skb, __be32 net_seq);
1991
1992static inline int xfrm_aevent_is_on(struct net *net)
1993{
1994 struct sock *nlsk;
1995 int ret = 0;
1996
1997 rcu_read_lock();
1998 nlsk = rcu_dereference(net->xfrm.nlsk);
1999 if (nlsk)
2000 ret = netlink_has_listeners(nlsk, XFRMNLGRP_AEVENTS);
2001 rcu_read_unlock();
2002 return ret;
2003}
2004
2005static inline int xfrm_acquire_is_on(struct net *net)
2006{
2007 struct sock *nlsk;
2008 int ret = 0;
2009
2010 rcu_read_lock();
2011 nlsk = rcu_dereference(net->xfrm.nlsk);
2012 if (nlsk)
2013 ret = netlink_has_listeners(nlsk, XFRMNLGRP_ACQUIRE);
2014 rcu_read_unlock();
2015
2016 return ret;
2017}
2018#endif
2019
2020static inline unsigned int aead_len(struct xfrm_algo_aead *alg)
2021{
2022 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
2023}
2024
2025static inline unsigned int xfrm_alg_len(const struct xfrm_algo *alg)
2026{
2027 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
2028}
2029
2030static inline unsigned int xfrm_alg_auth_len(const struct xfrm_algo_auth *alg)
2031{
2032 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
2033}
2034
2035static inline unsigned int xfrm_replay_state_esn_len(struct xfrm_replay_state_esn *replay_esn)
2036{
2037 return sizeof(*replay_esn) + replay_esn->bmp_len * sizeof(__u32);
2038}
2039
2040#ifdef CONFIG_XFRM_MIGRATE
2041static inline int xfrm_replay_clone(struct xfrm_state *x,
2042 const struct xfrm_state *orig)
2043{
2044 /* Counters synced later in xfrm_replay_sync() */
2045
2046 x->replay = orig->replay;
2047 x->preplay = orig->preplay;
2048
2049 if (orig->replay_esn) {
2050 x->replay_esn = kmemdup(orig->replay_esn,
2051 xfrm_replay_state_esn_len(orig->replay_esn),
2052 GFP_KERNEL);
2053 if (!x->replay_esn)
2054 return -ENOMEM;
2055 x->preplay_esn = kmemdup(orig->preplay_esn,
2056 xfrm_replay_state_esn_len(orig->preplay_esn),
2057 GFP_KERNEL);
2058 if (!x->preplay_esn)
2059 return -ENOMEM;
2060 }
2061
2062 return 0;
2063}
2064
2065static inline void xfrm_replay_sync(struct xfrm_state *x, const struct xfrm_state *orig)
2066{
2067 x->replay = orig->replay;
2068 x->preplay = orig->preplay;
2069
2070 if (orig->replay_esn) {
2071 memcpy(x->replay_esn, orig->replay_esn,
2072 xfrm_replay_state_esn_len(orig->replay_esn));
2073
2074 memcpy(x->preplay_esn, orig->preplay_esn,
2075 xfrm_replay_state_esn_len(orig->preplay_esn));
2076 }
2077}
2078
2079static inline void xfrm_migrate_sync(struct xfrm_state *x,
2080 const struct xfrm_state *orig)
2081{
2082 /* called under lock so no race conditions or mallocs allowed */
2083 memcpy(&x->curlft, &orig->curlft, sizeof(x->curlft));
2084 xfrm_replay_sync(x, orig);
2085}
2086
2087static inline struct xfrm_algo_aead *xfrm_algo_aead_clone(struct xfrm_algo_aead *orig)
2088{
2089 return kmemdup(orig, aead_len(orig), GFP_KERNEL);
2090}
2091
2092
2093static inline struct xfrm_algo *xfrm_algo_clone(struct xfrm_algo *orig)
2094{
2095 return kmemdup(orig, xfrm_alg_len(orig), GFP_KERNEL);
2096}
2097
2098static inline struct xfrm_algo_auth *xfrm_algo_auth_clone(struct xfrm_algo_auth *orig)
2099{
2100 return kmemdup(orig, xfrm_alg_auth_len(orig), GFP_KERNEL);
2101}
2102
2103static inline void xfrm_states_put(struct xfrm_state **states, int n)
2104{
2105 int i;
2106 for (i = 0; i < n; i++)
2107 xfrm_state_put(*(states + i));
2108}
2109
2110static inline void xfrm_states_delete(struct xfrm_state **states, int n)
2111{
2112 int i;
2113 for (i = 0; i < n; i++)
2114 xfrm_state_delete(*(states + i));
2115}
2116#endif
2117
2118void __init xfrm_dev_init(void);
2119
2120#ifdef CONFIG_XFRM_OFFLOAD
2121void xfrm_dev_resume(struct sk_buff *skb);
2122void xfrm_dev_backlog(struct softnet_data *sd);
2123struct sk_buff *validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t features, bool *again);
2124int xfrm_dev_state_add(struct net *net, struct xfrm_state *x,
2125 const struct xfrm_user_offload *xuo,
2126 struct netlink_ext_ack *extack);
2127int xfrm_dev_policy_add(struct net *net, struct xfrm_policy *xp,
2128 struct xfrm_user_offload *xuo, u8 dir,
2129 struct netlink_ext_ack *extack);
2130bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x);
2131void xfrm_dev_state_delete(struct xfrm_state *x);
2132void xfrm_dev_state_free(struct xfrm_state *x);
2133
2134static inline void xfrm_dev_state_advance_esn(struct xfrm_state *x)
2135{
2136 struct xfrm_dev_offload *xso = &x->xso;
2137 struct net_device *dev = READ_ONCE(xso->dev);
2138
2139 if (dev && dev->xfrmdev_ops->xdo_dev_state_advance_esn)
2140 dev->xfrmdev_ops->xdo_dev_state_advance_esn(x);
2141}
2142
2143static inline bool xfrm_dst_offload_ok(struct dst_entry *dst)
2144{
2145 struct xfrm_state *x = dst->xfrm;
2146 struct xfrm_dst *xdst;
2147
2148 if (!x || !x->type_offload)
2149 return false;
2150
2151 xdst = (struct xfrm_dst *) dst;
2152 if (!x->xso.offload_handle && !xdst->child->xfrm)
2153 return true;
2154 if (x->xso.offload_handle && (x->xso.dev == xfrm_dst_path(dst)->dev) &&
2155 !xdst->child->xfrm)
2156 return true;
2157
2158 return false;
2159}
2160
2161static inline void xfrm_dev_policy_delete(struct xfrm_policy *x)
2162{
2163 struct xfrm_dev_offload *xdo = &x->xdo;
2164 struct net_device *dev = xdo->dev;
2165
2166 if (dev && dev->xfrmdev_ops && dev->xfrmdev_ops->xdo_dev_policy_delete)
2167 dev->xfrmdev_ops->xdo_dev_policy_delete(x);
2168}
2169
2170static inline void xfrm_dev_policy_free(struct xfrm_policy *x)
2171{
2172 struct xfrm_dev_offload *xdo = &x->xdo;
2173 struct net_device *dev = xdo->dev;
2174
2175 if (dev && dev->xfrmdev_ops) {
2176 if (dev->xfrmdev_ops->xdo_dev_policy_free)
2177 dev->xfrmdev_ops->xdo_dev_policy_free(x);
2178 xdo->dev = NULL;
2179 netdev_put(dev, &xdo->dev_tracker);
2180 }
2181}
2182#else
2183static inline void xfrm_dev_resume(struct sk_buff *skb)
2184{
2185}
2186
2187static inline void xfrm_dev_backlog(struct softnet_data *sd)
2188{
2189}
2190
2191static inline struct sk_buff *validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t features, bool *again)
2192{
2193 return skb;
2194}
2195
2196static inline int xfrm_dev_state_add(struct net *net, struct xfrm_state *x,
2197 const struct xfrm_user_offload *xuo,
2198 struct netlink_ext_ack *extack)
2199{
2200 return 0;
2201}
2202
2203static inline void xfrm_dev_state_delete(struct xfrm_state *x)
2204{
2205}
2206
2207static inline void xfrm_dev_state_free(struct xfrm_state *x)
2208{
2209}
2210
2211static inline int xfrm_dev_policy_add(struct net *net, struct xfrm_policy *xp,
2212 struct xfrm_user_offload *xuo, u8 dir,
2213 struct netlink_ext_ack *extack)
2214{
2215 return 0;
2216}
2217
2218static inline void xfrm_dev_policy_delete(struct xfrm_policy *x)
2219{
2220}
2221
2222static inline void xfrm_dev_policy_free(struct xfrm_policy *x)
2223{
2224}
2225
2226static inline bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x)
2227{
2228 return false;
2229}
2230
2231static inline void xfrm_dev_state_advance_esn(struct xfrm_state *x)
2232{
2233}
2234
2235static inline bool xfrm_dst_offload_ok(struct dst_entry *dst)
2236{
2237 return false;
2238}
2239#endif
2240
2241static inline int xfrm_mark_get(struct nlattr **attrs, struct xfrm_mark *m)
2242{
2243 if (attrs[XFRMA_MARK])
2244 memcpy(m, nla_data(attrs[XFRMA_MARK]), sizeof(struct xfrm_mark));
2245 else
2246 m->v = m->m = 0;
2247
2248 return m->v & m->m;
2249}
2250
2251static inline int xfrm_mark_put(struct sk_buff *skb, const struct xfrm_mark *m)
2252{
2253 int ret = 0;
2254
2255 if (m->m | m->v)
2256 ret = nla_put(skb, XFRMA_MARK, sizeof(struct xfrm_mark), m);
2257 return ret;
2258}
2259
2260static inline __u32 xfrm_smark_get(__u32 mark, struct xfrm_state *x)
2261{
2262 struct xfrm_mark *m = &x->props.smark;
2263
2264 return (m->v & m->m) | (mark & ~m->m);
2265}
2266
2267static inline int xfrm_if_id_put(struct sk_buff *skb, __u32 if_id)
2268{
2269 int ret = 0;
2270
2271 if (if_id)
2272 ret = nla_put_u32(skb, XFRMA_IF_ID, if_id);
2273 return ret;
2274}
2275
2276static inline int xfrm_tunnel_check(struct sk_buff *skb, struct xfrm_state *x,
2277 unsigned int family)
2278{
2279 bool tunnel = false;
2280
2281 switch(family) {
2282 case AF_INET:
2283 if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4)
2284 tunnel = true;
2285 break;
2286 case AF_INET6:
2287 if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6)
2288 tunnel = true;
2289 break;
2290 }
2291 if (tunnel && !(x->outer_mode.flags & XFRM_MODE_FLAG_TUNNEL))
2292 return -EINVAL;
2293
2294 return 0;
2295}
2296
2297extern const int xfrm_msg_min[XFRM_NR_MSGTYPES];
2298extern const struct nla_policy xfrma_policy[XFRMA_MAX+1];
2299
2300struct xfrm_translator {
2301 /* Allocate frag_list and put compat translation there */
2302 int (*alloc_compat)(struct sk_buff *skb, const struct nlmsghdr *src);
2303
2304 /* Allocate nlmsg with 64-bit translaton of received 32-bit message */
2305 struct nlmsghdr *(*rcv_msg_compat)(const struct nlmsghdr *nlh,
2306 int maxtype, const struct nla_policy *policy,
2307 struct netlink_ext_ack *extack);
2308
2309 /* Translate 32-bit user_policy from sockptr */
2310 int (*xlate_user_policy_sockptr)(u8 **pdata32, int optlen);
2311
2312 struct module *owner;
2313};
2314
2315#if IS_ENABLED(CONFIG_XFRM_USER_COMPAT)
2316extern int xfrm_register_translator(struct xfrm_translator *xtr);
2317extern int xfrm_unregister_translator(struct xfrm_translator *xtr);
2318extern struct xfrm_translator *xfrm_get_translator(void);
2319extern void xfrm_put_translator(struct xfrm_translator *xtr);
2320#else
2321static inline struct xfrm_translator *xfrm_get_translator(void)
2322{
2323 return NULL;
2324}
2325static inline void xfrm_put_translator(struct xfrm_translator *xtr)
2326{
2327}
2328#endif
2329
2330#if IS_ENABLED(CONFIG_IPV6)
2331static inline bool xfrm6_local_dontfrag(const struct sock *sk)
2332{
2333 int proto;
2334
2335 if (!sk || sk->sk_family != AF_INET6)
2336 return false;
2337
2338 proto = sk->sk_protocol;
2339 if (proto == IPPROTO_UDP || proto == IPPROTO_RAW)
2340 return inet6_test_bit(DONTFRAG, sk);
2341
2342 return false;
2343}
2344#endif
2345
2346#if (IS_BUILTIN(CONFIG_XFRM_INTERFACE) && IS_ENABLED(CONFIG_DEBUG_INFO_BTF)) || \
2347 (IS_MODULE(CONFIG_XFRM_INTERFACE) && IS_ENABLED(CONFIG_DEBUG_INFO_BTF_MODULES))
2348
2349extern struct metadata_dst __percpu *xfrm_bpf_md_dst;
2350
2351int register_xfrm_interface_bpf(void);
2352
2353#else
2354
2355static inline int register_xfrm_interface_bpf(void)
2356{
2357 return 0;
2358}
2359
2360#endif
2361
2362#if IS_ENABLED(CONFIG_DEBUG_INFO_BTF)
2363int register_xfrm_state_bpf(void);
2364#else
2365static inline int register_xfrm_state_bpf(void)
2366{
2367 return 0;
2368}
2369#endif
2370
2371int xfrm_nat_keepalive_init(unsigned short family);
2372void xfrm_nat_keepalive_fini(unsigned short family);
2373int xfrm_nat_keepalive_net_init(struct net *net);
2374int xfrm_nat_keepalive_net_fini(struct net *net);
2375void xfrm_nat_keepalive_state_updated(struct xfrm_state *x);
2376
2377#endif /* _NET_XFRM_H */