projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Merge branch 'devel' of master.kernel.org:/home/rmk/linux-2.6-serial
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / include / net / xfrm.h
CommitLineData
1da177e4
LT		 1#ifndef _NET_XFRM_H
2#define _NET_XFRM_H
3
aabc9761 4#include <linux/compiler.h>
14c85021 5#include <linux/in.h>
1da177e4
LT		 6#include <linux/xfrm.h>
7#include <linux/spinlock.h>
8#include <linux/list.h>
9#include <linux/skbuff.h>
14c85021 10#include <linux/socket.h>
1da177e4
LT		 11#include <linux/crypto.h>
12#include <linux/pfkeyv2.h>
13#include <linux/in6.h>
4a3e2f71 14#include <linux/mutex.h>
1da177e4
LT		 15
16#include <net/sock.h>
17#include <net/dst.h>
18#include <net/route.h>
19#include <net/ipv6.h>
20#include <net/ip6_fib.h>
21
22#define XFRM_ALIGN8(len) (((len) + 7) & ~7)
b59f45d0
HX		 23#define MODULE_ALIAS_XFRM_MODE(family, encap) \
24 MODULE_ALIAS("xfrm-mode-" __stringify(family) "-" __stringify(encap))
1da177e4 25
f8cd5488
JHS		 26extern struct sock *xfrm_nl;
27extern u32 sysctl_xfrm_aevent_etime;
28extern u32 sysctl_xfrm_aevent_rseqth;
29
4a3e2f71 30extern struct mutex xfrm_cfg_mutex;
1da177e4
LT		 31
32/* Organization of SPD aka "XFRM rules"
33 ------------------------------------
34
35 Basic objects:
36 - policy rule, struct xfrm_policy (=SPD entry)
37 - bundle of transformations, struct dst_entry == struct xfrm_dst (=SA bundle)
38 - instance of a transformer, struct xfrm_state (=SA)
39 - template to clone xfrm_state, struct xfrm_tmpl
40
41 SPD is plain linear list of xfrm_policy rules, ordered by priority.
42 (To be compatible with existing pfkeyv2 implementations,
43 many rules with priority of 0x7fffffff are allowed to exist and
44 such rules are ordered in an unpredictable way, thanks to bsd folks.)
45
46 Lookup is plain linear search until the first match with selector.
47
48 If "action" is "block", then we prohibit the flow, otherwise:
49 if "xfrms_nr" is zero, the flow passes untransformed. Otherwise,
50 policy entry has list of up to XFRM_MAX_DEPTH transformations,
51 described by templates xfrm_tmpl. Each template is resolved
52 to a complete xfrm_state (see below) and we pack bundle of transformations
53 to a dst_entry returned to requestor.
54
55 dst -. xfrm .-> xfrm_state #1
56 |---. child .-> dst -. xfrm .-> xfrm_state #2
57 |---. child .-> dst -. xfrm .-> xfrm_state #3
58 |---. child .-> NULL
59
60 Bundles are cached at xrfm_policy struct (field ->bundles).
61
62
63 Resolution of xrfm_tmpl
64 -----------------------
65 Template contains:
66 1. ->mode Mode: transport or tunnel
67 2. ->id.proto Protocol: AH/ESP/IPCOMP
68 3. ->id.daddr Remote tunnel endpoint, ignored for transport mode.
69 Q: allow to resolve security gateway?
70 4. ->id.spi If not zero, static SPI.
71 5. ->saddr Local tunnel endpoint, ignored for transport mode.
72 6. ->algos List of allowed algos. Plain bitmask now.
73 Q: ealgos, aalgos, calgos. What a mess...
74 7. ->share Sharing mode.
75 Q: how to implement private sharing mode? To add struct sock* to
76 flow id?
77
78 Having this template we search through SAD searching for entries
79 with appropriate mode/proto/algo, permitted by selector.
80 If no appropriate entry found, it is requested from key manager.
81
82 PROBLEMS:
83 Q: How to find all the bundles referring to a physical path for
84 PMTU discovery? Seems, dst should contain list of all parents...
85 and enter to infinite locking hierarchy disaster.
86 No! It is easier, we will not search for them, let them find us.
87 We add genid to each dst plus pointer to genid of raw IP route,
88 pmtu disc will update pmtu on raw IP route and increase its genid.
89 dst_check() will see this for top level and trigger resyncing
90 metrics. Plus, it will be made via sk->sk_dst_cache. Solved.
91 */
92
93/* Full description of state of transformer. */
94struct xfrm_state
95{
96 /* Note: bydst is re-used during gc */
97 struct list_head bydst;
98 struct list_head byspi;
99
100 atomic_t refcnt;
101 spinlock_t lock;
102
103 struct xfrm_id id;
104 struct xfrm_selector sel;
105
106 /* Key manger bits */
107 struct {
108 u8 state;
109 u8 dying;
110 u32 seq;
111 } km;
112
113 /* Parameters of this state. */
114 struct {
115 u32 reqid;
116 u8 mode;
117 u8 replay_window;
118 u8 aalgo, ealgo, calgo;
119 u8 flags;
120 u16 family;
121 xfrm_address_t saddr;
122 int header_len;
123 int trailer_len;
124 } props;
125
126 struct xfrm_lifetime_cfg lft;
127
128 /* Data for transformer */
129 struct xfrm_algo *aalg;
130 struct xfrm_algo *ealg;
131 struct xfrm_algo *calg;
132
133 /* Data for encapsulator */
134 struct xfrm_encap_tmpl *encap;
135
136 /* IPComp needs an IPIP tunnel for handling uncompressed packets */
137 struct xfrm_state *tunnel;
138
139 /* If a tunnel, number of users + 1 */
140 atomic_t tunnel_users;
141
142 /* State for replay detection */
143 struct xfrm_replay_state replay;
144
f8cd5488
JHS		 145 /* Replay detection state at the time we sent the last notification */
146 struct xfrm_replay_state preplay;
147
2717096a
JHS		 148 /* internal flag that only holds state for delayed aevent at the
149 * moment
150 */
151 u32 xflags;
152
f8cd5488
JHS		 153 /* Replay detection notification settings */
154 u32 replay_maxage;
155 u32 replay_maxdiff;
156
157 /* Replay detection notification timer */
158 struct timer_list rtimer;
159
1da177e4
LT		 160 /* Statistics */
161 struct xfrm_stats stats;
162
163 struct xfrm_lifetime_cur curlft;
164 struct timer_list timer;
165
166 /* Reference to data common to all the instances of this
167 * transformer. */
168 struct xfrm_type *type;
b59f45d0 169 struct xfrm_mode *mode;
1da177e4 170
df71837d
TJ		 171 /* Security context */
172 struct xfrm_sec_ctx *security;
173
1da177e4
LT		 174 /* Private data of this transformer, format is opaque,
175 * interpreted by xfrm_type methods. */
176 void *data;
177};
178
2717096a
JHS		 179/* xflags - make enum if more show up */
180#define XFRM_TIME_DEFER 1
181
1da177e4
LT		 182enum {
183 XFRM_STATE_VOID,
184 XFRM_STATE_ACQ,
185 XFRM_STATE_VALID,
186 XFRM_STATE_ERROR,
187 XFRM_STATE_EXPIRED,
188 XFRM_STATE_DEAD
189};
190
26b15dad
JHS		 191/* callback structure passed from either netlink or pfkey */
192struct km_event
193{
bf08867f
HX		 194 union {
195 u32 hard;
196 u32 proto;
197 u32 byid;
f8cd5488 198 u32 aevent;
bf08867f
HX		 199 } data;
200
26b15dad
JHS		 201 u32 seq;
202 u32 pid;
203 u32 event;
204};
205
1da177e4
LT		 206struct xfrm_type;
207struct xfrm_dst;
208struct xfrm_policy_afinfo {
209 unsigned short family;
73654d61 210 struct xfrm_type *type_map[IPPROTO_MAX];
b59f45d0 211 struct xfrm_mode *mode_map[XFRM_MODE_MAX];
1da177e4
LT		 212 struct dst_ops *dst_ops;
213 void (*garbage_collect)(void);
214 int (*dst_lookup)(struct xfrm_dst **dst, struct flowi *fl);
215 struct dst_entry *(*find_bundle)(struct flowi *fl, struct xfrm_policy *policy);
216 int (*bundle_create)(struct xfrm_policy *policy,
217 struct xfrm_state **xfrm,
218 int nx,
219 struct flowi *fl,
220 struct dst_entry **dst_p);
221 void (*decode_session)(struct sk_buff *skb,
222 struct flowi *fl);
223};
224
225extern int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo);
226extern int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo);
26b15dad
JHS		 227extern void km_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c);
228extern void km_state_notify(struct xfrm_state *x, struct km_event *c);
1da177e4
LT		 229#define XFRM_ACQ_EXPIRES 30
230
231struct xfrm_tmpl;
980ebd25 232extern int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol);
53bc6b4d
JHS		 233extern void km_state_expired(struct xfrm_state *x, int hard, u32 pid);
234extern int __xfrm_state_delete(struct xfrm_state *x);
235
1da177e4
LT		 236struct xfrm_state_afinfo {
237 unsigned short family;
1da177e4
LT		 238 struct list_head *state_bydst;
239 struct list_head *state_byspi;
d094cd83 240 int (*init_flags)(struct xfrm_state *x);
1da177e4
LT		 241 void (*init_tempsel)(struct xfrm_state *x, struct flowi *fl,
242 struct xfrm_tmpl *tmpl,
243 xfrm_address_t *daddr, xfrm_address_t *saddr);
244 struct xfrm_state *(*state_lookup)(xfrm_address_t *daddr, u32 spi, u8 proto);
245 struct xfrm_state *(*find_acq)(u8 mode, u32 reqid, u8 proto,
246 xfrm_address_t *daddr, xfrm_address_t *saddr,
247 int create);
248};
249
250extern int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo);
251extern int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo);
252
253extern void xfrm_state_delete_tunnel(struct xfrm_state *x);
254
1da177e4
LT		 255struct xfrm_type
256{
257 char *description;
258 struct module *owner;
259 __u8 proto;
260
72cb6962 261 int (*init_state)(struct xfrm_state *x);
1da177e4 262 void (*destructor)(struct xfrm_state *);
e695633e 263 int (*input)(struct xfrm_state *, struct sk_buff *skb);
1da177e4
LT		 264 int (*output)(struct xfrm_state *, struct sk_buff *pskb);
265 /* Estimate maximal size of result of transformation of a dgram */
266 u32 (*get_max_size)(struct xfrm_state *, int size);
267};
268
1da177e4
LT		 269extern int xfrm_register_type(struct xfrm_type *type, unsigned short family);
270extern int xfrm_unregister_type(struct xfrm_type *type, unsigned short family);
271extern struct xfrm_type *xfrm_get_type(u8 proto, unsigned short family);
272extern void xfrm_put_type(struct xfrm_type *type);
273
b59f45d0
HX		 274struct xfrm_mode {
275 int (*input)(struct xfrm_state *x, struct sk_buff *skb);
276 int (*output)(struct sk_buff *skb);
277
278 struct module *owner;
279 unsigned int encap;
280};
281
282extern int xfrm_register_mode(struct xfrm_mode *mode, int family);
283extern int xfrm_unregister_mode(struct xfrm_mode *mode, int family);
284extern struct xfrm_mode *xfrm_get_mode(unsigned int encap, int family);
285extern void xfrm_put_mode(struct xfrm_mode *mode);
286
1da177e4
LT		 287struct xfrm_tmpl
288{
289/* id in template is interpreted as:
290 * daddr - destination of tunnel, may be zero for transport mode.
291 * spi - zero to acquire spi. Not zero if spi is static, then
292 * daddr must be fixed too.
293 * proto - AH/ESP/IPCOMP
294 */
295 struct xfrm_id id;
296
297/* Source address of tunnel. Ignored, if it is not a tunnel. */
298 xfrm_address_t saddr;
299
300 __u32 reqid;
301
302/* Mode: transport/tunnel */
303 __u8 mode;
304
305/* Sharing mode: unique, this session only, this user only etc. */
306 __u8 share;
307
308/* May skip this transfomration if no SA is found */
309 __u8 optional;
310
311/* Bit mask of algos allowed for acquisition */
312 __u32 aalgos;
313 __u32 ealgos;
314 __u32 calgos;
315};
316
317#define XFRM_MAX_DEPTH 4
318
319struct xfrm_policy
320{
321 struct xfrm_policy *next;
322 struct list_head list;
323
324 /* This lock only affects elements except for entry. */
325 rwlock_t lock;
326 atomic_t refcnt;
327 struct timer_list timer;
328
329 u32 priority;
330 u32 index;
331 struct xfrm_selector selector;
332 struct xfrm_lifetime_cfg lft;
333 struct xfrm_lifetime_cur curlft;
334 struct dst_entry *bundles;
335 __u16 family;
336 __u8 action;
337 __u8 flags;
338 __u8 dead;
339 __u8 xfrm_nr;
df71837d 340 struct xfrm_sec_ctx *security;
1da177e4
LT		 341 struct xfrm_tmpl xfrm_vec[XFRM_MAX_DEPTH];
342};
343
f8cd5488
JHS		 344#define XFRM_KM_TIMEOUT 30
345/* which seqno */
346#define XFRM_REPLAY_SEQ 1
347#define XFRM_REPLAY_OSEQ 2
348#define XFRM_REPLAY_SEQ_MASK 3
349/* what happened */
350#define XFRM_REPLAY_UPDATE XFRM_AE_CR
351#define XFRM_REPLAY_TIMEOUT XFRM_AE_CE
352
353/* default aevent timeout in units of 100ms */
354#define XFRM_AE_ETIME 10
355/* Async Event timer multiplier */
356#define XFRM_AE_ETH_M 10
357/* default seq threshold size */
358#define XFRM_AE_SEQT_SIZE 2
1da177e4
LT		 359
360struct xfrm_mgr
361{
362 struct list_head list;
363 char *id;
26b15dad 364 int (*notify)(struct xfrm_state *x, struct km_event *c);
1da177e4
LT		 365 int (*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp, int dir);
366 struct xfrm_policy *(*compile_policy)(u16 family, int opt, u8 *data, int len, int *dir);
367 int (*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, u16 sport);
26b15dad 368 int (*notify_policy)(struct xfrm_policy *x, int dir, struct km_event *c);
1da177e4
LT		 369};
370
371extern int xfrm_register_km(struct xfrm_mgr *km);
372extern int xfrm_unregister_km(struct xfrm_mgr *km);
373
374
375extern struct xfrm_policy *xfrm_policy_list[XFRM_POLICY_MAX*2];
376
377static inline void xfrm_pol_hold(struct xfrm_policy *policy)
378{
379 if (likely(policy != NULL))
380 atomic_inc(&policy->refcnt);
381}
382
383extern void __xfrm_policy_destroy(struct xfrm_policy *policy);
384
385static inline void xfrm_pol_put(struct xfrm_policy *policy)
386{
387 if (atomic_dec_and_test(&policy->refcnt))
388 __xfrm_policy_destroy(policy);
389}
390
391#define XFRM_DST_HSIZE 1024
392
393static __inline__
394unsigned __xfrm4_dst_hash(xfrm_address_t *addr)
395{
396 unsigned h;
397 h = ntohl(addr->a4);
398 h = (h ^ (h>>16)) % XFRM_DST_HSIZE;
399 return h;
400}
401
402static __inline__
403unsigned __xfrm6_dst_hash(xfrm_address_t *addr)
404{
405 unsigned h;
406 h = ntohl(addr->a6[2]^addr->a6[3]);
407 h = (h ^ (h>>16)) % XFRM_DST_HSIZE;
408 return h;
409}
410
411static __inline__
412unsigned xfrm_dst_hash(xfrm_address_t *addr, unsigned short family)
413{
414 switch (family) {
415 case AF_INET:
416 return __xfrm4_dst_hash(addr);
417 case AF_INET6:
418 return __xfrm6_dst_hash(addr);
419 }
420 return 0;
421}
422
423static __inline__
424unsigned __xfrm4_spi_hash(xfrm_address_t *addr, u32 spi, u8 proto)
425{
426 unsigned h;
427 h = ntohl(addr->a4^spi^proto);
428 h = (h ^ (h>>10) ^ (h>>20)) % XFRM_DST_HSIZE;
429 return h;
430}
431
432static __inline__
433unsigned __xfrm6_spi_hash(xfrm_address_t *addr, u32 spi, u8 proto)
434{
435 unsigned h;
436 h = ntohl(addr->a6[2]^addr->a6[3]^spi^proto);
437 h = (h ^ (h>>10) ^ (h>>20)) % XFRM_DST_HSIZE;
438 return h;
439}
440
441static __inline__
442unsigned xfrm_spi_hash(xfrm_address_t *addr, u32 spi, u8 proto, unsigned short family)
443{
444 switch (family) {
445 case AF_INET:
446 return __xfrm4_spi_hash(addr, spi, proto);
447 case AF_INET6:
448 return __xfrm6_spi_hash(addr, spi, proto);
449 }
450 return 0; /*XXX*/
451}
452
453extern void __xfrm_state_destroy(struct xfrm_state *);
454
21380b81
HX		 455static inline void __xfrm_state_put(struct xfrm_state *x)
456{
457 atomic_dec(&x->refcnt);
458}
459
1da177e4
LT		 460static inline void xfrm_state_put(struct xfrm_state *x)
461{
462 if (atomic_dec_and_test(&x->refcnt))
463 __xfrm_state_destroy(x);
464}
465
466static inline void xfrm_state_hold(struct xfrm_state *x)
467{
468 atomic_inc(&x->refcnt);
469}
470
471static __inline__ int addr_match(void *token1, void *token2, int prefixlen)
472{
473 __u32 *a1 = token1;
474 __u32 *a2 = token2;
475 int pdw;
476 int pbi;
477
478 pdw = prefixlen >> 5; /* num of whole __u32 in prefix */
479 pbi = prefixlen & 0x1f; /* num of bits in incomplete u32 in prefix */
480
481 if (pdw)
482 if (memcmp(a1, a2, pdw << 2))
483 return 0;
484
485 if (pbi) {
486 __u32 mask;
487
488 mask = htonl((0xffffffff) << (32 - pbi));
489
490 if ((a1[pdw] ^ a2[pdw]) & mask)
491 return 0;
492 }
493
494 return 1;
495}
496
497static __inline__
498u16 xfrm_flowi_sport(struct flowi *fl)
499{
500 u16 port;
501 switch(fl->proto) {
502 case IPPROTO_TCP:
503 case IPPROTO_UDP:
504 case IPPROTO_SCTP:
505 port = fl->fl_ip_sport;
506 break;
507 case IPPROTO_ICMP:
508 case IPPROTO_ICMPV6:
509 port = htons(fl->fl_icmp_type);
510 break;
511 default:
512 port = 0; /*XXX*/
513 }
514 return port;
515}
516
517static __inline__
518u16 xfrm_flowi_dport(struct flowi *fl)
519{
520 u16 port;
521 switch(fl->proto) {
522 case IPPROTO_TCP:
523 case IPPROTO_UDP:
524 case IPPROTO_SCTP:
525 port = fl->fl_ip_dport;
526 break;
527 case IPPROTO_ICMP:
528 case IPPROTO_ICMPV6:
529 port = htons(fl->fl_icmp_code);
530 break;
531 default:
532 port = 0; /*XXX*/
533 }
534 return port;
535}
536
537static inline int
538__xfrm4_selector_match(struct xfrm_selector *sel, struct flowi *fl)
539{
540 return addr_match(&fl->fl4_dst, &sel->daddr, sel->prefixlen_d) &&
541 addr_match(&fl->fl4_src, &sel->saddr, sel->prefixlen_s) &&
542 !((xfrm_flowi_dport(fl) ^ sel->dport) & sel->dport_mask) &&
543 !((xfrm_flowi_sport(fl) ^ sel->sport) & sel->sport_mask) &&
544 (fl->proto == sel->proto || !sel->proto) &&
545 (fl->oif == sel->ifindex || !sel->ifindex);
546}
547
548static inline int
549__xfrm6_selector_match(struct xfrm_selector *sel, struct flowi *fl)
550{
551 return addr_match(&fl->fl6_dst, &sel->daddr, sel->prefixlen_d) &&
552 addr_match(&fl->fl6_src, &sel->saddr, sel->prefixlen_s) &&
553 !((xfrm_flowi_dport(fl) ^ sel->dport) & sel->dport_mask) &&
554 !((xfrm_flowi_sport(fl) ^ sel->sport) & sel->sport_mask) &&
555 (fl->proto == sel->proto || !sel->proto) &&
556 (fl->oif == sel->ifindex || !sel->ifindex);
557}
558
559static inline int
560xfrm_selector_match(struct xfrm_selector *sel, struct flowi *fl,
561 unsigned short family)
562{
563 switch (family) {
564 case AF_INET:
565 return __xfrm4_selector_match(sel, fl);
566 case AF_INET6:
567 return __xfrm6_selector_match(sel, fl);
568 }
569 return 0;
570}
571
df71837d
TJ		 572#ifdef CONFIG_SECURITY_NETWORK_XFRM
573/* If neither has a context --> match
574 * Otherwise, both must have a context and the sids, doi, alg must match
575 */
576static inline int xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
577{
578 return ((!s1 && !s2) ||
579 (s1 && s2 &&
580 (s1->ctx_sid == s2->ctx_sid) &&
581 (s1->ctx_doi == s2->ctx_doi) &&
582 (s1->ctx_alg == s2->ctx_alg)));
583}
584#else
585static inline int xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
586{
587 return 1;
588}
589#endif
590
1da177e4
LT		 591/* A struct encoding bundle of transformations to apply to some set of flow.
592 *
593 * dst->child points to the next element of bundle.
594 * dst->xfrm points to an instanse of transformer.
595 *
596 * Due to unfortunate limitations of current routing cache, which we
597 * have no time to fix, it mirrors struct rtable and bound to the same
598 * routing key, including saddr,daddr. However, we can have many of
599 * bundles differing by session id. All the bundles grow from a parent
600 * policy rule.
601 */
602struct xfrm_dst
603{
604 union {
605 struct xfrm_dst *next;
606 struct dst_entry dst;
607 struct rtable rt;
608 struct rt6_info rt6;
609 } u;
610 struct dst_entry *route;
611 u32 route_mtu_cached;
612 u32 child_mtu_cached;
92d63dec
HY		 613 u32 route_cookie;
614 u32 path_cookie;
1da177e4
LT		 615};
616
aabc9761
HX		 617static inline void xfrm_dst_destroy(struct xfrm_dst *xdst)
618{
619 dst_release(xdst->route);
620 if (likely(xdst->u.dst.xfrm))
621 xfrm_state_put(xdst->u.dst.xfrm);
622}
623
624extern void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev);
625
1da177e4
LT		 626struct sec_path
627{
628 atomic_t refcnt;
629 int len;
dbe5b4aa 630 struct xfrm_state *xvec[XFRM_MAX_DEPTH];
1da177e4
LT		 631};
632
633static inline struct sec_path *
634secpath_get(struct sec_path *sp)
635{
636 if (sp)
637 atomic_inc(&sp->refcnt);
638 return sp;
639}
640
641extern void __secpath_destroy(struct sec_path *sp);
642
643static inline void
644secpath_put(struct sec_path *sp)
645{
646 if (sp && atomic_dec_and_test(&sp->refcnt))
647 __secpath_destroy(sp);
648}
649
650extern struct sec_path *secpath_dup(struct sec_path *src);
651
652static inline void
653secpath_reset(struct sk_buff *skb)
654{
655#ifdef CONFIG_XFRM
656 secpath_put(skb->sp);
657 skb->sp = NULL;
658#endif
659}
660
661static inline int
662__xfrm4_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x)
663{
664 return (tmpl->saddr.a4 &&
665 tmpl->saddr.a4 != x->props.saddr.a4);
666}
667
668static inline int
669__xfrm6_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x)
670{
671 return (!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) &&
672 ipv6_addr_cmp((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr));
673}
674
675static inline int
676xfrm_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x, unsigned short family)
677{
678 switch (family) {
679 case AF_INET:
680 return __xfrm4_state_addr_cmp(tmpl, x);
681 case AF_INET6:
682 return __xfrm6_state_addr_cmp(tmpl, x);
683 }
684 return !0;
685}
686
687#ifdef CONFIG_XFRM
688
689extern int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb, unsigned short family);
690
691static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
692{
693 if (sk && sk->sk_policy[XFRM_POLICY_IN])
694 return __xfrm_policy_check(sk, dir, skb, family);
695
696 return (!xfrm_policy_list[dir] && !skb->sp) ||
697 (skb->dst->flags & DST_NOPOLICY) ||
698 __xfrm_policy_check(sk, dir, skb, family);
699}
700
701static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
702{
703 return xfrm_policy_check(sk, dir, skb, AF_INET);
704}
705
706static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
707{
708 return xfrm_policy_check(sk, dir, skb, AF_INET6);
709}
710
3e3850e9 711extern int xfrm_decode_session(struct sk_buff *skb, struct flowi *fl, unsigned short family);
1da177e4
LT		 712extern int __xfrm_route_forward(struct sk_buff *skb, unsigned short family);
713
714static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family)
715{
716 return !xfrm_policy_list[XFRM_POLICY_OUT] ||
717 (skb->dst->flags & DST_NOXFRM) ||
718 __xfrm_route_forward(skb, family);
719}
720
721static inline int xfrm4_route_forward(struct sk_buff *skb)
722{
723 return xfrm_route_forward(skb, AF_INET);
724}
725
726static inline int xfrm6_route_forward(struct sk_buff *skb)
727{
728 return xfrm_route_forward(skb, AF_INET6);
729}
730
731extern int __xfrm_sk_clone_policy(struct sock *sk);
732
733static inline int xfrm_sk_clone_policy(struct sock *sk)
734{
735 if (unlikely(sk->sk_policy[0] || sk->sk_policy[1]))
736 return __xfrm_sk_clone_policy(sk);
737 return 0;
738}
739
4666faab 740extern int xfrm_policy_delete(struct xfrm_policy *pol, int dir);
1da177e4
LT		 741
742static inline void xfrm_sk_free_policy(struct sock *sk)
743{
744 if (unlikely(sk->sk_policy[0] != NULL)) {
745 xfrm_policy_delete(sk->sk_policy[0], XFRM_POLICY_MAX);
746 sk->sk_policy[0] = NULL;
747 }
748 if (unlikely(sk->sk_policy[1] != NULL)) {
749 xfrm_policy_delete(sk->sk_policy[1], XFRM_POLICY_MAX+1);
750 sk->sk_policy[1] = NULL;
751 }
752}
753
754#else
755
756static inline void xfrm_sk_free_policy(struct sock *sk) {}
757static inline int xfrm_sk_clone_policy(struct sock *sk) { return 0; }
758static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; }
759static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; }
760static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
761{
762 return 1;
763}
764static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
765{
766 return 1;
767}
768static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
769{
770 return 1;
771}
772#endif
773
774static __inline__
775xfrm_address_t *xfrm_flowi_daddr(struct flowi *fl, unsigned short family)
776{
777 switch (family){
778 case AF_INET:
779 return (xfrm_address_t *)&fl->fl4_dst;
780 case AF_INET6:
781 return (xfrm_address_t *)&fl->fl6_dst;
782 }
783 return NULL;
784}
785
786static __inline__
787xfrm_address_t *xfrm_flowi_saddr(struct flowi *fl, unsigned short family)
788{
789 switch (family){
790 case AF_INET:
791 return (xfrm_address_t *)&fl->fl4_src;
792 case AF_INET6:
793 return (xfrm_address_t *)&fl->fl6_src;
794 }
795 return NULL;
796}
797
798static __inline__ int
799__xfrm4_state_addr_check(struct xfrm_state *x,
800 xfrm_address_t *daddr, xfrm_address_t *saddr)
801{
802 if (daddr->a4 == x->id.daddr.a4 &&
803 (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4))
804 return 1;
805 return 0;
806}
807
808static __inline__ int
809__xfrm6_state_addr_check(struct xfrm_state *x,
810 xfrm_address_t *daddr, xfrm_address_t *saddr)
811{
812 if (!ipv6_addr_cmp((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) &&
813 (!ipv6_addr_cmp((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr)||
814 ipv6_addr_any((struct in6_addr *)saddr) ||
815 ipv6_addr_any((struct in6_addr *)&x->props.saddr)))
816 return 1;
817 return 0;
818}
819
820static __inline__ int
821xfrm_state_addr_check(struct xfrm_state *x,
822 xfrm_address_t *daddr, xfrm_address_t *saddr,
823 unsigned short family)
824{
825 switch (family) {
826 case AF_INET:
827 return __xfrm4_state_addr_check(x, daddr, saddr);
828 case AF_INET6:
829 return __xfrm6_state_addr_check(x, daddr, saddr);
830 }
831 return 0;
832}
833
834static inline int xfrm_state_kern(struct xfrm_state *x)
835{
836 return atomic_read(&x->tunnel_users);
837}
838
839/*
840 * xfrm algorithm information
841 */
842struct xfrm_algo_auth_info {
843 u16 icv_truncbits;
844 u16 icv_fullbits;
845};
846
847struct xfrm_algo_encr_info {
848 u16 blockbits;
849 u16 defkeybits;
850};
851
852struct xfrm_algo_comp_info {
853 u16 threshold;
854};
855
856struct xfrm_algo_desc {
857 char *name;
858 u8 available:1;
859 union {
860 struct xfrm_algo_auth_info auth;
861 struct xfrm_algo_encr_info encr;
862 struct xfrm_algo_comp_info comp;
863 } uinfo;
864 struct sadb_alg desc;
865};
866
867/* XFRM tunnel handlers. */
868struct xfrm_tunnel {
869 int (*handler)(struct sk_buff *skb);
d2acc347
HX		 870 int (*err_handler)(struct sk_buff *skb, __u32 info);
871
872 struct xfrm_tunnel *next;
873 int priority;
1da177e4
LT		 874};
875
876struct xfrm6_tunnel {
d2acc347
HX		 877 int (*handler)(struct sk_buff *skb);
878 int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
879 int type, int code, int offset, __u32 info);
880
881 struct xfrm6_tunnel *next;
882 int priority;
1da177e4
LT		 883};
884
885extern void xfrm_init(void);
886extern void xfrm4_init(void);
887extern void xfrm6_init(void);
888extern void xfrm6_fini(void);
889extern void xfrm_state_init(void);
890extern void xfrm4_state_init(void);
1da177e4
LT		 891extern void xfrm6_state_init(void);
892extern void xfrm6_state_fini(void);
893
894extern int xfrm_state_walk(u8 proto, int (*func)(struct xfrm_state *, int, void*), void *);
895extern struct xfrm_state *xfrm_state_alloc(void);
896extern struct xfrm_state *xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
897 struct flowi *fl, struct xfrm_tmpl *tmpl,
898 struct xfrm_policy *pol, int *err,
899 unsigned short family);
900extern int xfrm_state_check_expire(struct xfrm_state *x);
901extern void xfrm_state_insert(struct xfrm_state *x);
902extern int xfrm_state_add(struct xfrm_state *x);
903extern int xfrm_state_update(struct xfrm_state *x);
904extern struct xfrm_state *xfrm_state_lookup(xfrm_address_t *daddr, u32 spi, u8 proto, unsigned short family);
905extern struct xfrm_state *xfrm_find_acq_byseq(u32 seq);
26b15dad 906extern int xfrm_state_delete(struct xfrm_state *x);
1da177e4
LT		 907extern void xfrm_state_flush(u8 proto);
908extern int xfrm_replay_check(struct xfrm_state *x, u32 seq);
909extern void xfrm_replay_advance(struct xfrm_state *x, u32 seq);
f8cd5488 910extern void xfrm_replay_notify(struct xfrm_state *x, int event);
1da177e4
LT		 911extern int xfrm_state_check(struct xfrm_state *x, struct sk_buff *skb);
912extern int xfrm_state_mtu(struct xfrm_state *x, int mtu);
72cb6962 913extern int xfrm_init_state(struct xfrm_state *x);
1da177e4
LT		 914extern int xfrm4_rcv(struct sk_buff *skb);
915extern int xfrm4_output(struct sk_buff *skb);
916extern int xfrm4_tunnel_register(struct xfrm_tunnel *handler);
917extern int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler);
d2acc347 918extern int xfrm6_rcv_spi(struct sk_buff *skb, u32 spi);
951dbc8a 919extern int xfrm6_rcv(struct sk_buff **pskb);
1da177e4
LT		 920extern int xfrm6_tunnel_register(struct xfrm6_tunnel *handler);
921extern int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler);
922extern u32 xfrm6_tunnel_alloc_spi(xfrm_address_t *saddr);
923extern void xfrm6_tunnel_free_spi(xfrm_address_t *saddr);
924extern u32 xfrm6_tunnel_spi_lookup(xfrm_address_t *saddr);
925extern int xfrm6_output(struct sk_buff *skb);
926
927#ifdef CONFIG_XFRM
928extern int xfrm4_rcv_encap(struct sk_buff *skb, __u16 encap_type);
929extern int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen);
930extern int xfrm_dst_lookup(struct xfrm_dst **dst, struct flowi *fl, unsigned short family);
931#else
932static inline int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
933{
934 return -ENOPROTOOPT;
935}
936
937static inline int xfrm4_rcv_encap(struct sk_buff *skb, __u16 encap_type)
938{
939 /* should not happen */
940 kfree_skb(skb);
941 return 0;
942}
943static inline int xfrm_dst_lookup(struct xfrm_dst **dst, struct flowi *fl, unsigned short family)
944{
945 return -EINVAL;
946}
947#endif
948
dd0fc66f 949struct xfrm_policy *xfrm_policy_alloc(gfp_t gfp);
1da177e4
LT		 950extern int xfrm_policy_walk(int (*func)(struct xfrm_policy *, int, int, void*), void *);
951int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl);
df71837d
TJ		 952struct xfrm_policy *xfrm_policy_bysel_ctx(int dir, struct xfrm_selector *sel,
953 struct xfrm_sec_ctx *ctx, int delete);
1da177e4
LT		 954struct xfrm_policy *xfrm_policy_byid(int dir, u32 id, int delete);
955void xfrm_policy_flush(void);
956u32 xfrm_get_acqseq(void);
957void xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi);
958struct xfrm_state * xfrm_find_acq(u8 mode, u32 reqid, u8 proto,
959 xfrm_address_t *daddr, xfrm_address_t *saddr,
960 int create, unsigned short family);
961extern void xfrm_policy_flush(void);
962extern int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol);
963extern int xfrm_flush_bundles(void);
399c180a 964extern void xfrm_flush_all_bundles(void);
1da177e4
LT		 965extern int xfrm_bundle_ok(struct xfrm_dst *xdst, struct flowi *fl, int family);
966extern void xfrm_init_pmtu(struct dst_entry *dst);
967
968extern wait_queue_head_t km_waitq;
969extern int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, u16 sport);
6c5c8ca7 970extern void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 pid);
1da177e4
LT		 971
972extern void xfrm_input_init(void);
973extern int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, u32 *spi, u32 *seq);
974
975extern void xfrm_probe_algs(void);
976extern int xfrm_count_auth_supported(void);
977extern int xfrm_count_enc_supported(void);
978extern struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx);
979extern struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx);
980extern struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id);
981extern struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id);
982extern struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id);
983extern struct xfrm_algo_desc *xfrm_aalg_get_byname(char *name, int probe);
984extern struct xfrm_algo_desc *xfrm_ealg_get_byname(char *name, int probe);
985extern struct xfrm_algo_desc *xfrm_calg_get_byname(char *name, int probe);
986
987struct crypto_tfm;
988typedef void (icv_update_fn_t)(struct crypto_tfm *, struct scatterlist *, unsigned int);
989
990extern void skb_icv_walk(const struct sk_buff *skb, struct crypto_tfm *tfm,
991 int offset, int len, icv_update_fn_t icv_update);
992
993static inline int xfrm_addr_cmp(xfrm_address_t *a, xfrm_address_t *b,
994 int family)
995{
996 switch (family) {
997 default:
998 case AF_INET:
999 return a->a4 - b->a4;
1000 case AF_INET6:
1001 return ipv6_addr_cmp((struct in6_addr *)a,
1002 (struct in6_addr *)b);
1003 }
1004}
1005
77d8d7a6
HX		 1006static inline int xfrm_policy_id2dir(u32 index)
1007{
1008 return index & 7;
1009}
1010
f8cd5488
JHS		 1011static inline int xfrm_aevent_is_on(void)
1012{
be33690d
PM		 1013 struct sock *nlsk;
1014 int ret = 0;
1015
1016 rcu_read_lock();
1017 nlsk = rcu_dereference(xfrm_nl);
1018 if (nlsk)
1019 ret = netlink_has_listeners(nlsk, XFRMNLGRP_AEVENTS);
1020 rcu_read_unlock();
1021 return ret;
f8cd5488
JHS		 1022}
1023
1024static inline void xfrm_aevent_doreplay(struct xfrm_state *x)
1025{
1026 if (xfrm_aevent_is_on())
1027 xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
1028}
1029
1030
1da177e4 1031#endif /* _NET_XFRM_H */
kernel source for telekom puls (alcatel/mediatek)