1/* SPDX-License-Identifier: GPL-2.0 */ 2#ifndef _NET_XFRM_H 3#define _NET_XFRM_H 4 5#include <linux/compiler.h> 6#include <linux/xfrm.h> 7#include <linux/spinlock.h> 8#include <linux/list.h> 9#include <linux/skbuff.h> 10#include <linux/socket.h> 11#include <linux/pfkeyv2.h> 12#include <linux/ipsec.h> 13#include <linux/in6.h> 14#include <linux/mutex.h> 15#include <linux/audit.h> 16#include <linux/slab.h> 17#include <linux/refcount.h> 18#include <linux/sockptr.h> 19 20#include <net/sock.h> 21#include <net/dst.h> 22#include <net/ip.h> 23#include <net/route.h> 24#include <net/ipv6.h> 25#include <net/ip6_fib.h> 26#include <net/flow.h> 27#include <net/gro_cells.h> 28 29#include <linux/interrupt.h> 30 31#ifdef CONFIG_XFRM_STATISTICS 32#include <net/snmp.h> 33#endif 34 35#define XFRM_PROTO_ESP 50 36#define XFRM_PROTO_AH 51 37#define XFRM_PROTO_COMP 108 38#define XFRM_PROTO_IPIP 4 39#define XFRM_PROTO_IPV6 41 40#define XFRM_PROTO_ROUTING IPPROTO_ROUTING 41#define XFRM_PROTO_DSTOPTS IPPROTO_DSTOPTS 42 43#define XFRM_ALIGN4(len) (((len) + 3) & ~3) 44#define XFRM_ALIGN8(len) (((len) + 7) & ~7) 45#define MODULE_ALIAS_XFRM_MODE(family, encap) \ 46 MODULE_ALIAS("xfrm-mode-" __stringify(family) "-" __stringify(encap)) 47#define MODULE_ALIAS_XFRM_TYPE(family, proto) \ 48 MODULE_ALIAS("xfrm-type-" __stringify(family) "-" __stringify(proto)) 49#define MODULE_ALIAS_XFRM_OFFLOAD_TYPE(family, proto) \ 50 MODULE_ALIAS("xfrm-offload-" __stringify(family) "-" __stringify(proto)) 51 52#ifdef CONFIG_XFRM_STATISTICS 53#define XFRM_INC_STATS(net, field) SNMP_INC_STATS((net)->mib.xfrm_statistics, field) 54#else 55#define XFRM_INC_STATS(net, field) ((void)(net)) 56#endif 57 58 59/* Organization of SPD aka "XFRM rules" 60 ------------------------------------ 61 62 Basic objects: 63 - policy rule, struct xfrm_policy (=SPD entry) 64 - bundle of transformations, struct dst_entry == struct xfrm_dst (=SA bundle) 65 - instance of a transformer, struct xfrm_state (=SA) 66 - template to clone xfrm_state, struct xfrm_tmpl 67 68 SPD is plain linear list of xfrm_policy rules, ordered by priority. 69 (To be compatible with existing pfkeyv2 implementations, 70 many rules with priority of 0x7fffffff are allowed to exist and 71 such rules are ordered in an unpredictable way, thanks to bsd folks.) 72 73 Lookup is plain linear search until the first match with selector. 74 75 If "action" is "block", then we prohibit the flow, otherwise: 76 if "xfrms_nr" is zero, the flow passes untransformed. Otherwise, 77 policy entry has list of up to XFRM_MAX_DEPTH transformations, 78 described by templates xfrm_tmpl. Each template is resolved 79 to a complete xfrm_state (see below) and we pack bundle of transformations 80 to a dst_entry returned to requestor. 81 82 dst -. xfrm .-> xfrm_state #1 83 |---. child .-> dst -. xfrm .-> xfrm_state #2 84 |---. child .-> dst -. xfrm .-> xfrm_state #3 85 |---. child .-> NULL 86 87 Bundles are cached at xrfm_policy struct (field ->bundles). 88 89 90 Resolution of xrfm_tmpl 91 ----------------------- 92 Template contains: 93 1. ->mode Mode: transport or tunnel 94 2. ->id.proto Protocol: AH/ESP/IPCOMP 95 3. ->id.daddr Remote tunnel endpoint, ignored for transport mode. 96 Q: allow to resolve security gateway? 97 4. ->id.spi If not zero, static SPI. 98 5. ->saddr Local tunnel endpoint, ignored for transport mode. 99 6. ->algos List of allowed algos. Plain bitmask now. 100 Q: ealgos, aalgos, calgos. What a mess... 101 7. ->share Sharing mode. 102 Q: how to implement private sharing mode? To add struct sock* to 103 flow id? 104 105 Having this template we search through SAD searching for entries 106 with appropriate mode/proto/algo, permitted by selector. 107 If no appropriate entry found, it is requested from key manager. 108 109 PROBLEMS: 110 Q: How to find all the bundles referring to a physical path for 111 PMTU discovery? Seems, dst should contain list of all parents... 112 and enter to infinite locking hierarchy disaster. 113 No! It is easier, we will not search for them, let them find us. 114 We add genid to each dst plus pointer to genid of raw IP route, 115 pmtu disc will update pmtu on raw IP route and increase its genid. 116 dst_check() will see this for top level and trigger resyncing 117 metrics. Plus, it will be made via sk->sk_dst_cache. Solved. 118 */ 119 120struct xfrm_state_walk { 121 struct list_head all; 122 u8 state; 123 u8 dying; 124 u8 proto; 125 u32 seq; 126 struct xfrm_address_filter *filter; 127}; 128 129struct xfrm_state_offload { 130 struct net_device *dev; 131 struct net_device *real_dev; 132 unsigned long offload_handle; 133 unsigned int num_exthdrs; 134 u8 flags; 135}; 136 137struct xfrm_mode { 138 u8 encap; 139 u8 family; 140 u8 flags; 141}; 142 143/* Flags for xfrm_mode. */ 144enum { 145 XFRM_MODE_FLAG_TUNNEL = 1, 146}; 147 148/* Full description of state of transformer. */ 149struct xfrm_state { 150 possible_net_t xs_net; 151 union { 152 struct hlist_node gclist; 153 struct hlist_node bydst; 154 }; 155 struct hlist_node bysrc; 156 struct hlist_node byspi; 157 158 refcount_t refcnt; 159 spinlock_t lock; 160 161 struct xfrm_id id; 162 struct xfrm_selector sel; 163 struct xfrm_mark mark; 164 u32 if_id; 165 u32 tfcpad; 166 167 u32 genid; 168 169 /* Key manager bits */ 170 struct xfrm_state_walk km; 171 172 /* Parameters of this state. */ 173 struct { 174 u32 reqid; 175 u8 mode; 176 u8 replay_window; 177 u8 aalgo, ealgo, calgo; 178 u8 flags; 179 u16 family; 180 xfrm_address_t saddr; 181 int header_len; 182 int trailer_len; 183 u32 extra_flags; 184 struct xfrm_mark smark; 185 } props; 186 187 struct xfrm_lifetime_cfg lft; 188 189 /* Data for transformer */ 190 struct xfrm_algo_auth *aalg; 191 struct xfrm_algo *ealg; 192 struct xfrm_algo *calg; 193 struct xfrm_algo_aead *aead; 194 const char *geniv; 195 196 /* mapping change rate limiting */ 197 __be16 new_mapping_sport; 198 u32 new_mapping; /* seconds */ 199 u32 mapping_maxage; /* seconds for input SA */ 200 201 /* Data for encapsulator */ 202 struct xfrm_encap_tmpl *encap; 203 struct sock __rcu *encap_sk; 204 205 /* Data for care-of address */ 206 xfrm_address_t *coaddr; 207 208 /* IPComp needs an IPIP tunnel for handling uncompressed packets */ 209 struct xfrm_state *tunnel; 210 211 /* If a tunnel, number of users + 1 */ 212 atomic_t tunnel_users; 213 214 /* State for replay detection */ 215 struct xfrm_replay_state replay; 216 struct xfrm_replay_state_esn *replay_esn; 217 218 /* Replay detection state at the time we sent the last notification */ 219 struct xfrm_replay_state preplay; 220 struct xfrm_replay_state_esn *preplay_esn; 221 222 /* The functions for replay detection. */ 223 const struct xfrm_replay *repl; 224 225 /* internal flag that only holds state for delayed aevent at the 226 * moment 227 */ 228 u32 xflags; 229 230 /* Replay detection notification settings */ 231 u32 replay_maxage; 232 u32 replay_maxdiff; 233 234 /* Replay detection notification timer */ 235 struct timer_list rtimer; 236 237 /* Statistics */ 238 struct xfrm_stats stats; 239 240 struct xfrm_lifetime_cur curlft; 241 struct hrtimer mtimer; 242 243 struct xfrm_state_offload xso; 244 245 /* used to fix curlft->add_time when changing date */ 246 long saved_tmo; 247 248 /* Last used time */ 249 time64_t lastused; 250 251 struct page_frag xfrag; 252 253 /* Reference to data common to all the instances of this 254 * transformer. */ 255 const struct xfrm_type *type; 256 struct xfrm_mode inner_mode; 257 struct xfrm_mode inner_mode_iaf; 258 struct xfrm_mode outer_mode; 259 260 const struct xfrm_type_offload *type_offload; 261 262 /* Security context */ 263 struct xfrm_sec_ctx *security; 264 265 /* Private data of this transformer, format is opaque, 266 * interpreted by xfrm_type methods. */ 267 void *data; 268}; 269 270static inline struct net *xs_net(struct xfrm_state *x) 271{ 272 return read_pnet(&x->xs_net); 273} 274 275/* xflags - make enum if more show up */ 276#define XFRM_TIME_DEFER 1 277#define XFRM_SOFT_EXPIRE 2 278 279enum { 280 XFRM_STATE_VOID, 281 XFRM_STATE_ACQ, 282 XFRM_STATE_VALID, 283 XFRM_STATE_ERROR, 284 XFRM_STATE_EXPIRED, 285 XFRM_STATE_DEAD 286}; 287 288/* callback structure passed from either netlink or pfkey */ 289struct km_event { 290 union { 291 u32 hard; 292 u32 proto; 293 u32 byid; 294 u32 aevent; 295 u32 type; 296 } data; 297 298 u32 seq; 299 u32 portid; 300 u32 event; 301 struct net *net; 302}; 303 304struct xfrm_replay { 305 void (*advance)(struct xfrm_state *x, __be32 net_seq); 306 int (*check)(struct xfrm_state *x, 307 struct sk_buff *skb, 308 __be32 net_seq); 309 int (*recheck)(struct xfrm_state *x, 310 struct sk_buff *skb, 311 __be32 net_seq); 312 void (*notify)(struct xfrm_state *x, int event); 313 int (*overflow)(struct xfrm_state *x, struct sk_buff *skb); 314}; 315 316struct xfrm_if_cb { 317 struct xfrm_if *(*decode_session)(struct sk_buff *skb, 318 unsigned short family); 319}; 320 321void xfrm_if_register_cb(const struct xfrm_if_cb *ifcb); 322void xfrm_if_unregister_cb(void); 323 324struct net_device; 325struct xfrm_type; 326struct xfrm_dst; 327struct xfrm_policy_afinfo { 328 struct dst_ops *dst_ops; 329 struct dst_entry *(*dst_lookup)(struct net *net, 330 int tos, int oif, 331 const xfrm_address_t *saddr, 332 const xfrm_address_t *daddr, 333 u32 mark); 334 int (*get_saddr)(struct net *net, int oif, 335 xfrm_address_t *saddr, 336 xfrm_address_t *daddr, 337 u32 mark); 338 int (*fill_dst)(struct xfrm_dst *xdst, 339 struct net_device *dev, 340 const struct flowi *fl); 341 struct dst_entry *(*blackhole_route)(struct net *net, struct dst_entry *orig); 342}; 343 344int xfrm_policy_register_afinfo(const struct xfrm_policy_afinfo *afinfo, int family); 345void xfrm_policy_unregister_afinfo(const struct xfrm_policy_afinfo *afinfo); 346void km_policy_notify(struct xfrm_policy *xp, int dir, 347 const struct km_event *c); 348void km_state_notify(struct xfrm_state *x, const struct km_event *c); 349 350struct xfrm_tmpl; 351int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, 352 struct xfrm_policy *pol); 353void km_state_expired(struct xfrm_state *x, int hard, u32 portid); 354int __xfrm_state_delete(struct xfrm_state *x); 355 356struct xfrm_state_afinfo { 357 u8 family; 358 u8 proto; 359 360 const struct xfrm_type_offload *type_offload_esp; 361 362 const struct xfrm_type *type_esp; 363 const struct xfrm_type *type_ipip; 364 const struct xfrm_type *type_ipip6; 365 const struct xfrm_type *type_comp; 366 const struct xfrm_type *type_ah; 367 const struct xfrm_type *type_routing; 368 const struct xfrm_type *type_dstopts; 369 370 int (*output)(struct net *net, struct sock *sk, struct sk_buff *skb); 371 int (*transport_finish)(struct sk_buff *skb, 372 int async); 373 void (*local_error)(struct sk_buff *skb, u32 mtu); 374}; 375 376int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo); 377int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo); 378struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family); 379struct xfrm_state_afinfo *xfrm_state_afinfo_get_rcu(unsigned int family); 380 381struct xfrm_input_afinfo { 382 u8 family; 383 bool is_ipip; 384 int (*callback)(struct sk_buff *skb, u8 protocol, 385 int err); 386}; 387 388int xfrm_input_register_afinfo(const struct xfrm_input_afinfo *afinfo); 389int xfrm_input_unregister_afinfo(const struct xfrm_input_afinfo *afinfo); 390 391void xfrm_flush_gc(void); 392void xfrm_state_delete_tunnel(struct xfrm_state *x); 393 394struct xfrm_type { 395 char *description; 396 struct module *owner; 397 u8 proto; 398 u8 flags; 399#define XFRM_TYPE_NON_FRAGMENT 1 400#define XFRM_TYPE_REPLAY_PROT 2 401#define XFRM_TYPE_LOCAL_COADDR 4 402#define XFRM_TYPE_REMOTE_COADDR 8 403 404 int (*init_state)(struct xfrm_state *x); 405 void (*destructor)(struct xfrm_state *); 406 int (*input)(struct xfrm_state *, struct sk_buff *skb); 407 int (*output)(struct xfrm_state *, struct sk_buff *pskb); 408 int (*reject)(struct xfrm_state *, struct sk_buff *, 409 const struct flowi *); 410 int (*hdr_offset)(struct xfrm_state *, struct sk_buff *, u8 **); 411}; 412 413int xfrm_register_type(const struct xfrm_type *type, unsigned short family); 414void xfrm_unregister_type(const struct xfrm_type *type, unsigned short family); 415 416struct xfrm_type_offload { 417 char *description; 418 struct module *owner; 419 u8 proto; 420 void (*encap)(struct xfrm_state *, struct sk_buff *pskb); 421 int (*input_tail)(struct xfrm_state *x, struct sk_buff *skb); 422 int (*xmit)(struct xfrm_state *, struct sk_buff *pskb, netdev_features_t features); 423}; 424 425int xfrm_register_type_offload(const struct xfrm_type_offload *type, unsigned short family); 426void xfrm_unregister_type_offload(const struct xfrm_type_offload *type, unsigned short family); 427 428static inline int xfrm_af2proto(unsigned int family) 429{ 430 switch(family) { 431 case AF_INET: 432 return IPPROTO_IPIP; 433 case AF_INET6: 434 return IPPROTO_IPV6; 435 default: 436 return 0; 437 } 438} 439 440static inline const struct xfrm_mode *xfrm_ip2inner_mode(struct xfrm_state *x, int ipproto) 441{ 442 if ((ipproto == IPPROTO_IPIP && x->props.family == AF_INET) || 443 (ipproto == IPPROTO_IPV6 && x->props.family == AF_INET6)) 444 return &x->inner_mode; 445 else 446 return &x->inner_mode_iaf; 447} 448 449struct xfrm_tmpl { 450/* id in template is interpreted as: 451 * daddr - destination of tunnel, may be zero for transport mode. 452 * spi - zero to acquire spi. Not zero if spi is static, then 453 * daddr must be fixed too. 454 * proto - AH/ESP/IPCOMP 455 */ 456 struct xfrm_id id; 457 458/* Source address of tunnel. Ignored, if it is not a tunnel. */ 459 xfrm_address_t saddr; 460 461 unsigned short encap_family; 462 463 u32 reqid; 464 465/* Mode: transport, tunnel etc. */ 466 u8 mode; 467 468/* Sharing mode: unique, this session only, this user only etc. */ 469 u8 share; 470 471/* May skip this transfomration if no SA is found */ 472 u8 optional; 473 474/* Skip aalgos/ealgos/calgos checks. */ 475 u8 allalgs; 476 477/* Bit mask of algos allowed for acquisition */ 478 u32 aalgos; 479 u32 ealgos; 480 u32 calgos; 481}; 482 483#define XFRM_MAX_DEPTH 6 484#define XFRM_MAX_OFFLOAD_DEPTH 1 485 486struct xfrm_policy_walk_entry { 487 struct list_head all; 488 u8 dead; 489}; 490 491struct xfrm_policy_walk { 492 struct xfrm_policy_walk_entry walk; 493 u8 type; 494 u32 seq; 495}; 496 497struct xfrm_policy_queue { 498 struct sk_buff_head hold_queue; 499 struct timer_list hold_timer; 500 unsigned long timeout; 501}; 502 503struct xfrm_policy { 504 possible_net_t xp_net; 505 struct hlist_node bydst; 506 struct hlist_node byidx; 507 508 /* This lock only affects elements except for entry. */ 509 rwlock_t lock; 510 refcount_t refcnt; 511 u32 pos; 512 struct timer_list timer; 513 514 atomic_t genid; 515 u32 priority; 516 u32 index; 517 u32 if_id; 518 struct xfrm_mark mark; 519 struct xfrm_selector selector; 520 struct xfrm_lifetime_cfg lft; 521 struct xfrm_lifetime_cur curlft; 522 struct xfrm_policy_walk_entry walk; 523 struct xfrm_policy_queue polq; 524 bool bydst_reinsert; 525 u8 type; 526 u8 action; 527 u8 flags; 528 u8 xfrm_nr; 529 u16 family; 530 struct xfrm_sec_ctx *security; 531 struct xfrm_tmpl xfrm_vec[XFRM_MAX_DEPTH]; 532 struct hlist_node bydst_inexact_list; 533 struct rcu_head rcu; 534}; 535 536static inline struct net *xp_net(const struct xfrm_policy *xp) 537{ 538 return read_pnet(&xp->xp_net); 539} 540 541struct xfrm_kmaddress { 542 xfrm_address_t local; 543 xfrm_address_t remote; 544 u32 reserved; 545 u16 family; 546}; 547 548struct xfrm_migrate { 549 xfrm_address_t old_daddr; 550 xfrm_address_t old_saddr; 551 xfrm_address_t new_daddr; 552 xfrm_address_t new_saddr; 553 u8 proto; 554 u8 mode; 555 u16 reserved; 556 u32 reqid; 557 u16 old_family; 558 u16 new_family; 559}; 560 561#define XFRM_KM_TIMEOUT 30 562/* what happened */ 563#define XFRM_REPLAY_UPDATE XFRM_AE_CR 564#define XFRM_REPLAY_TIMEOUT XFRM_AE_CE 565 566/* default aevent timeout in units of 100ms */ 567#define XFRM_AE_ETIME 10 568/* Async Event timer multiplier */ 569#define XFRM_AE_ETH_M 10 570/* default seq threshold size */ 571#define XFRM_AE_SEQT_SIZE 2 572 573struct xfrm_mgr { 574 struct list_head list; 575 int (*notify)(struct xfrm_state *x, const struct km_event *c); 576 int (*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp); 577 struct xfrm_policy *(*compile_policy)(struct sock *sk, int opt, u8 *data, int len, int *dir); 578 int (*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport); 579 int (*notify_policy)(struct xfrm_policy *x, int dir, const struct km_event *c); 580 int (*report)(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr); 581 int (*migrate)(const struct xfrm_selector *sel, 582 u8 dir, u8 type, 583 const struct xfrm_migrate *m, 584 int num_bundles, 585 const struct xfrm_kmaddress *k, 586 const struct xfrm_encap_tmpl *encap); 587 bool (*is_alive)(const struct km_event *c); 588}; 589 590int xfrm_register_km(struct xfrm_mgr *km); 591int xfrm_unregister_km(struct xfrm_mgr *km); 592 593struct xfrm_tunnel_skb_cb { 594 union { 595 struct inet_skb_parm h4; 596 struct inet6_skb_parm h6; 597 } header; 598 599 union { 600 struct ip_tunnel *ip4; 601 struct ip6_tnl *ip6; 602 } tunnel; 603}; 604 605#define XFRM_TUNNEL_SKB_CB(__skb) ((struct xfrm_tunnel_skb_cb *)&((__skb)->cb[0])) 606 607/* 608 * This structure is used for the duration where packets are being 609 * transformed by IPsec. As soon as the packet leaves IPsec the 610 * area beyond the generic IP part may be overwritten. 611 */ 612struct xfrm_skb_cb { 613 struct xfrm_tunnel_skb_cb header; 614 615 /* Sequence number for replay protection. */ 616 union { 617 struct { 618 __u32 low; 619 __u32 hi; 620 } output; 621 struct { 622 __be32 low; 623 __be32 hi; 624 } input; 625 } seq; 626}; 627 628#define XFRM_SKB_CB(__skb) ((struct xfrm_skb_cb *)&((__skb)->cb[0])) 629 630/* 631 * This structure is used by the afinfo prepare_input/prepare_output functions 632 * to transmit header information to the mode input/output functions. 633 */ 634struct xfrm_mode_skb_cb { 635 struct xfrm_tunnel_skb_cb header; 636 637 /* Copied from header for IPv4, always set to zero and DF for IPv6. */ 638 __be16 id; 639 __be16 frag_off; 640 641 /* IP header length (excluding options or extension headers). */ 642 u8 ihl; 643 644 /* TOS for IPv4, class for IPv6. */ 645 u8 tos; 646 647 /* TTL for IPv4, hop limitfor IPv6. */ 648 u8 ttl; 649 650 /* Protocol for IPv4, NH for IPv6. */ 651 u8 protocol; 652 653 /* Option length for IPv4, zero for IPv6. */ 654 u8 optlen; 655 656 /* Used by IPv6 only, zero for IPv4. */ 657 u8 flow_lbl[3]; 658}; 659 660#define XFRM_MODE_SKB_CB(__skb) ((struct xfrm_mode_skb_cb *)&((__skb)->cb[0])) 661 662/* 663 * This structure is used by the input processing to locate the SPI and 664 * related information. 665 */ 666struct xfrm_spi_skb_cb { 667 struct xfrm_tunnel_skb_cb header; 668 669 unsigned int daddroff; 670 unsigned int family; 671 __be32 seq; 672}; 673 674#define XFRM_SPI_SKB_CB(__skb) ((struct xfrm_spi_skb_cb *)&((__skb)->cb[0])) 675 676#ifdef CONFIG_AUDITSYSCALL 677static inline struct audit_buffer *xfrm_audit_start(const char *op) 678{ 679 struct audit_buffer *audit_buf = NULL; 680 681 if (audit_enabled == AUDIT_OFF) 682 return NULL; 683 audit_buf = audit_log_start(audit_context(), GFP_ATOMIC, 684 AUDIT_MAC_IPSEC_EVENT); 685 if (audit_buf == NULL) 686 return NULL; 687 audit_log_format(audit_buf, "op=%s", op); 688 return audit_buf; 689} 690 691static inline void xfrm_audit_helper_usrinfo(bool task_valid, 692 struct audit_buffer *audit_buf) 693{ 694 const unsigned int auid = from_kuid(&init_user_ns, task_valid ? 695 audit_get_loginuid(current) : 696 INVALID_UID); 697 const unsigned int ses = task_valid ? audit_get_sessionid(current) : 698 AUDIT_SID_UNSET; 699 700 audit_log_format(audit_buf, " auid=%u ses=%u", auid, ses); 701 audit_log_task_context(audit_buf); 702} 703 704void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, bool task_valid); 705void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result, 706 bool task_valid); 707void xfrm_audit_state_add(struct xfrm_state *x, int result, bool task_valid); 708void xfrm_audit_state_delete(struct xfrm_state *x, int result, bool task_valid); 709void xfrm_audit_state_replay_overflow(struct xfrm_state *x, 710 struct sk_buff *skb); 711void xfrm_audit_state_replay(struct xfrm_state *x, struct sk_buff *skb, 712 __be32 net_seq); 713void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family); 714void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, __be32 net_spi, 715 __be32 net_seq); 716void xfrm_audit_state_icvfail(struct xfrm_state *x, struct sk_buff *skb, 717 u8 proto); 718#else 719 720static inline void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, 721 bool task_valid) 722{ 723} 724 725static inline void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result, 726 bool task_valid) 727{ 728} 729 730static inline void xfrm_audit_state_add(struct xfrm_state *x, int result, 731 bool task_valid) 732{ 733} 734 735static inline void xfrm_audit_state_delete(struct xfrm_state *x, int result, 736 bool task_valid) 737{ 738} 739 740static inline void xfrm_audit_state_replay_overflow(struct xfrm_state *x, 741 struct sk_buff *skb) 742{ 743} 744 745static inline void xfrm_audit_state_replay(struct xfrm_state *x, 746 struct sk_buff *skb, __be32 net_seq) 747{ 748} 749 750static inline void xfrm_audit_state_notfound_simple(struct sk_buff *skb, 751 u16 family) 752{ 753} 754 755static inline void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, 756 __be32 net_spi, __be32 net_seq) 757{ 758} 759 760static inline void xfrm_audit_state_icvfail(struct xfrm_state *x, 761 struct sk_buff *skb, u8 proto) 762{ 763} 764#endif /* CONFIG_AUDITSYSCALL */ 765 766static inline void xfrm_pol_hold(struct xfrm_policy *policy) 767{ 768 if (likely(policy != NULL)) 769 refcount_inc(&policy->refcnt); 770} 771 772void xfrm_policy_destroy(struct xfrm_policy *policy); 773 774static inline void xfrm_pol_put(struct xfrm_policy *policy) 775{ 776 if (refcount_dec_and_test(&policy->refcnt)) 777 xfrm_policy_destroy(policy); 778} 779 780static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols) 781{ 782 int i; 783 for (i = npols - 1; i >= 0; --i) 784 xfrm_pol_put(pols[i]); 785} 786 787void __xfrm_state_destroy(struct xfrm_state *, bool); 788 789static inline void __xfrm_state_put(struct xfrm_state *x) 790{ 791 refcount_dec(&x->refcnt); 792} 793 794static inline void xfrm_state_put(struct xfrm_state *x) 795{ 796 if (refcount_dec_and_test(&x->refcnt)) 797 __xfrm_state_destroy(x, false); 798} 799 800static inline void xfrm_state_put_sync(struct xfrm_state *x) 801{ 802 if (refcount_dec_and_test(&x->refcnt)) 803 __xfrm_state_destroy(x, true); 804} 805 806static inline void xfrm_state_hold(struct xfrm_state *x) 807{ 808 refcount_inc(&x->refcnt); 809} 810 811static inline bool addr_match(const void *token1, const void *token2, 812 unsigned int prefixlen) 813{ 814 const __be32 *a1 = token1; 815 const __be32 *a2 = token2; 816 unsigned int pdw; 817 unsigned int pbi; 818 819 pdw = prefixlen >> 5; /* num of whole u32 in prefix */ 820 pbi = prefixlen & 0x1f; /* num of bits in incomplete u32 in prefix */ 821 822 if (pdw) 823 if (memcmp(a1, a2, pdw << 2)) 824 return false; 825 826 if (pbi) { 827 __be32 mask; 828 829 mask = htonl((0xffffffff) << (32 - pbi)); 830 831 if ((a1[pdw] ^ a2[pdw]) & mask) 832 return false; 833 } 834 835 return true; 836} 837 838static inline bool addr4_match(__be32 a1, __be32 a2, u8 prefixlen) 839{ 840 /* C99 6.5.7 (3): u32 << 32 is undefined behaviour */ 841 if (sizeof(long) == 4 && prefixlen == 0) 842 return true; 843 return !((a1 ^ a2) & htonl(~0UL << (32 - prefixlen))); 844} 845 846static __inline__ 847__be16 xfrm_flowi_sport(const struct flowi *fl, const union flowi_uli *uli) 848{ 849 __be16 port; 850 switch(fl->flowi_proto) { 851 case IPPROTO_TCP: 852 case IPPROTO_UDP: 853 case IPPROTO_UDPLITE: 854 case IPPROTO_SCTP: 855 port = uli->ports.sport; 856 break; 857 case IPPROTO_ICMP: 858 case IPPROTO_ICMPV6: 859 port = htons(uli->icmpt.type); 860 break; 861 case IPPROTO_MH: 862 port = htons(uli->mht.type); 863 break; 864 case IPPROTO_GRE: 865 port = htons(ntohl(uli->gre_key) >> 16); 866 break; 867 default: 868 port = 0; /*XXX*/ 869 } 870 return port; 871} 872 873static __inline__ 874__be16 xfrm_flowi_dport(const struct flowi *fl, const union flowi_uli *uli) 875{ 876 __be16 port; 877 switch(fl->flowi_proto) { 878 case IPPROTO_TCP: 879 case IPPROTO_UDP: 880 case IPPROTO_UDPLITE: 881 case IPPROTO_SCTP: 882 port = uli->ports.dport; 883 break; 884 case IPPROTO_ICMP: 885 case IPPROTO_ICMPV6: 886 port = htons(uli->icmpt.code); 887 break; 888 case IPPROTO_GRE: 889 port = htons(ntohl(uli->gre_key) & 0xffff); 890 break; 891 default: 892 port = 0; /*XXX*/ 893 } 894 return port; 895} 896 897bool xfrm_selector_match(const struct xfrm_selector *sel, 898 const struct flowi *fl, unsigned short family); 899 900#ifdef CONFIG_SECURITY_NETWORK_XFRM 901/* If neither has a context --> match 902 * Otherwise, both must have a context and the sids, doi, alg must match 903 */ 904static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2) 905{ 906 return ((!s1 && !s2) || 907 (s1 && s2 && 908 (s1->ctx_sid == s2->ctx_sid) && 909 (s1->ctx_doi == s2->ctx_doi) && 910 (s1->ctx_alg == s2->ctx_alg))); 911} 912#else 913static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2) 914{ 915 return true; 916} 917#endif 918 919/* A struct encoding bundle of transformations to apply to some set of flow. 920 * 921 * xdst->child points to the next element of bundle. 922 * dst->xfrm points to an instanse of transformer. 923 * 924 * Due to unfortunate limitations of current routing cache, which we 925 * have no time to fix, it mirrors struct rtable and bound to the same 926 * routing key, including saddr,daddr. However, we can have many of 927 * bundles differing by session id. All the bundles grow from a parent 928 * policy rule. 929 */ 930struct xfrm_dst { 931 union { 932 struct dst_entry dst; 933 struct rtable rt; 934 struct rt6_info rt6; 935 } u; 936 struct dst_entry *route; 937 struct dst_entry *child; 938 struct dst_entry *path; 939 struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX]; 940 int num_pols, num_xfrms; 941 u32 xfrm_genid; 942 u32 policy_genid; 943 u32 route_mtu_cached; 944 u32 child_mtu_cached; 945 u32 route_cookie; 946 u32 path_cookie; 947}; 948 949static inline struct dst_entry *xfrm_dst_path(const struct dst_entry *dst) 950{ 951#ifdef CONFIG_XFRM 952 if (dst->xfrm || (dst->flags & DST_XFRM_QUEUE)) { 953 const struct xfrm_dst *xdst = (const struct xfrm_dst *) dst; 954 955 return xdst->path; 956 } 957#endif 958 return (struct dst_entry *) dst; 959} 960 961static inline struct dst_entry *xfrm_dst_child(const struct dst_entry *dst) 962{ 963#ifdef CONFIG_XFRM 964 if (dst->xfrm || (dst->flags & DST_XFRM_QUEUE)) { 965 struct xfrm_dst *xdst = (struct xfrm_dst *) dst; 966 return xdst->child; 967 } 968#endif 969 return NULL; 970} 971 972#ifdef CONFIG_XFRM 973static inline void xfrm_dst_set_child(struct xfrm_dst *xdst, struct dst_entry *child) 974{ 975 xdst->child = child; 976} 977 978static inline void xfrm_dst_destroy(struct xfrm_dst *xdst) 979{ 980 xfrm_pols_put(xdst->pols, xdst->num_pols); 981 dst_release(xdst->route); 982 if (likely(xdst->u.dst.xfrm)) 983 xfrm_state_put(xdst->u.dst.xfrm); 984} 985#endif 986 987void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev); 988 989struct xfrm_if_parms { 990 int link; /* ifindex of underlying L2 interface */ 991 u32 if_id; /* interface identifyer */ 992}; 993 994struct xfrm_if { 995 struct xfrm_if __rcu *next; /* next interface in list */ 996 struct net_device *dev; /* virtual device associated with interface */ 997 struct net *net; /* netns for packet i/o */ 998 struct xfrm_if_parms p; /* interface parms */ 999 1000 struct gro_cells gro_cells; 1001}; 1002 1003struct xfrm_offload { 1004 /* Output sequence number for replay protection on offloading. */ 1005 struct { 1006 __u32 low; 1007 __u32 hi; 1008 } seq; 1009 1010 __u32 flags; 1011#define SA_DELETE_REQ 1 1012#define CRYPTO_DONE 2 1013#define CRYPTO_NEXT_DONE 4 1014#define CRYPTO_FALLBACK 8 1015#define XFRM_GSO_SEGMENT 16 1016#define XFRM_GRO 32 1017#define XFRM_ESP_NO_TRAILER 64 1018#define XFRM_DEV_RESUME 128 1019#define XFRM_XMIT 256 1020 1021 __u32 status; 1022#define CRYPTO_SUCCESS 1 1023#define CRYPTO_GENERIC_ERROR 2 1024#define CRYPTO_TRANSPORT_AH_AUTH_FAILED 4 1025#define CRYPTO_TRANSPORT_ESP_AUTH_FAILED 8 1026#define CRYPTO_TUNNEL_AH_AUTH_FAILED 16 1027#define CRYPTO_TUNNEL_ESP_AUTH_FAILED 32 1028#define CRYPTO_INVALID_PACKET_SYNTAX 64 1029#define CRYPTO_INVALID_PROTOCOL 128 1030 1031 __u8 proto; 1032}; 1033 1034struct sec_path { 1035 int len; 1036 int olen; 1037 int verified_cnt; 1038 1039 struct xfrm_state *xvec[XFRM_MAX_DEPTH]; 1040 struct xfrm_offload ovec[XFRM_MAX_OFFLOAD_DEPTH]; 1041}; 1042 1043struct sec_path *secpath_set(struct sk_buff *skb); 1044 1045static inline void 1046secpath_reset(struct sk_buff *skb) 1047{ 1048#ifdef CONFIG_XFRM 1049 skb_ext_del(skb, SKB_EXT_SEC_PATH); 1050#endif 1051} 1052 1053static inline int 1054xfrm_addr_any(const xfrm_address_t *addr, unsigned short family) 1055{ 1056 switch (family) { 1057 case AF_INET: 1058 return addr->a4 == 0; 1059 case AF_INET6: 1060 return ipv6_addr_any(&addr->in6); 1061 } 1062 return 0; 1063} 1064 1065static inline int 1066__xfrm4_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x) 1067{ 1068 return (tmpl->saddr.a4 && 1069 tmpl->saddr.a4 != x->props.saddr.a4); 1070} 1071 1072static inline int 1073__xfrm6_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x) 1074{ 1075 return (!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) && 1076 !ipv6_addr_equal((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr)); 1077} 1078 1079static inline int 1080xfrm_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x, unsigned short family) 1081{ 1082 switch (family) { 1083 case AF_INET: 1084 return __xfrm4_state_addr_cmp(tmpl, x); 1085 case AF_INET6: 1086 return __xfrm6_state_addr_cmp(tmpl, x); 1087 } 1088 return !0; 1089} 1090 1091#ifdef CONFIG_XFRM 1092int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb, 1093 unsigned short family); 1094 1095static inline bool __xfrm_check_nopolicy(struct net *net, struct sk_buff *skb, 1096 int dir) 1097{ 1098 if (!net->xfrm.policy_count[dir] && !secpath_exists(skb)) 1099 return net->xfrm.policy_default[dir] == XFRM_USERPOLICY_ACCEPT; 1100 1101 return false; 1102} 1103 1104static inline bool __xfrm_check_dev_nopolicy(struct sk_buff *skb, 1105 int dir, unsigned short family) 1106{ 1107 if (dir != XFRM_POLICY_OUT && family == AF_INET) { 1108 /* same dst may be used for traffic originating from 1109 * devices with different policy settings. 1110 */ 1111 return IPCB(skb)->flags & IPSKB_NOPOLICY; 1112 } 1113 return skb_dst(skb) && (skb_dst(skb)->flags & DST_NOPOLICY); 1114} 1115 1116static inline int __xfrm_policy_check2(struct sock *sk, int dir, 1117 struct sk_buff *skb, 1118 unsigned int family, int reverse) 1119{ 1120 struct net *net = dev_net(skb->dev); 1121 int ndir = dir | (reverse ? XFRM_POLICY_MASK + 1 : 0); 1122 1123 if (sk && sk->sk_policy[XFRM_POLICY_IN]) 1124 return __xfrm_policy_check(sk, ndir, skb, family); 1125 1126 return __xfrm_check_nopolicy(net, skb, dir) || 1127 __xfrm_check_dev_nopolicy(skb, dir, family) || 1128 __xfrm_policy_check(sk, ndir, skb, family); 1129} 1130 1131static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family) 1132{ 1133 return __xfrm_policy_check2(sk, dir, skb, family, 0); 1134} 1135 1136static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 1137{ 1138 return xfrm_policy_check(sk, dir, skb, AF_INET); 1139} 1140 1141static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 1142{ 1143 return xfrm_policy_check(sk, dir, skb, AF_INET6); 1144} 1145 1146static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir, 1147 struct sk_buff *skb) 1148{ 1149 return __xfrm_policy_check2(sk, dir, skb, AF_INET, 1); 1150} 1151 1152static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir, 1153 struct sk_buff *skb) 1154{ 1155 return __xfrm_policy_check2(sk, dir, skb, AF_INET6, 1); 1156} 1157 1158int __xfrm_decode_session(struct sk_buff *skb, struct flowi *fl, 1159 unsigned int family, int reverse); 1160 1161static inline int xfrm_decode_session(struct sk_buff *skb, struct flowi *fl, 1162 unsigned int family) 1163{ 1164 return __xfrm_decode_session(skb, fl, family, 0); 1165} 1166 1167static inline int xfrm_decode_session_reverse(struct sk_buff *skb, 1168 struct flowi *fl, 1169 unsigned int family) 1170{ 1171 return __xfrm_decode_session(skb, fl, family, 1); 1172} 1173 1174int __xfrm_route_forward(struct sk_buff *skb, unsigned short family); 1175 1176static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family) 1177{ 1178 struct net *net = dev_net(skb->dev); 1179 1180 if (!net->xfrm.policy_count[XFRM_POLICY_OUT] && 1181 net->xfrm.policy_default[XFRM_POLICY_OUT] == XFRM_USERPOLICY_ACCEPT) 1182 return true; 1183 1184 return (skb_dst(skb)->flags & DST_NOXFRM) || 1185 __xfrm_route_forward(skb, family); 1186} 1187 1188static inline int xfrm4_route_forward(struct sk_buff *skb) 1189{ 1190 return xfrm_route_forward(skb, AF_INET); 1191} 1192 1193static inline int xfrm6_route_forward(struct sk_buff *skb) 1194{ 1195 return xfrm_route_forward(skb, AF_INET6); 1196} 1197 1198int __xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk); 1199 1200static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk) 1201{ 1202 if (!sk_fullsock(osk)) 1203 return 0; 1204 sk->sk_policy[0] = NULL; 1205 sk->sk_policy[1] = NULL; 1206 if (unlikely(osk->sk_policy[0] || osk->sk_policy[1])) 1207 return __xfrm_sk_clone_policy(sk, osk); 1208 return 0; 1209} 1210 1211int xfrm_policy_delete(struct xfrm_policy *pol, int dir); 1212 1213static inline void xfrm_sk_free_policy(struct sock *sk) 1214{ 1215 struct xfrm_policy *pol; 1216 1217 pol = rcu_dereference_protected(sk->sk_policy[0], 1); 1218 if (unlikely(pol != NULL)) { 1219 xfrm_policy_delete(pol, XFRM_POLICY_MAX); 1220 sk->sk_policy[0] = NULL; 1221 } 1222 pol = rcu_dereference_protected(sk->sk_policy[1], 1); 1223 if (unlikely(pol != NULL)) { 1224 xfrm_policy_delete(pol, XFRM_POLICY_MAX+1); 1225 sk->sk_policy[1] = NULL; 1226 } 1227} 1228 1229#else 1230 1231static inline void xfrm_sk_free_policy(struct sock *sk) {} 1232static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk) { return 0; } 1233static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; } 1234static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; } 1235static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 1236{ 1237 return 1; 1238} 1239static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 1240{ 1241 return 1; 1242} 1243static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family) 1244{ 1245 return 1; 1246} 1247static inline int xfrm_decode_session_reverse(struct sk_buff *skb, 1248 struct flowi *fl, 1249 unsigned int family) 1250{ 1251 return -ENOSYS; 1252} 1253static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir, 1254 struct sk_buff *skb) 1255{ 1256 return 1; 1257} 1258static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir, 1259 struct sk_buff *skb) 1260{ 1261 return 1; 1262} 1263#endif 1264 1265static __inline__ 1266xfrm_address_t *xfrm_flowi_daddr(const struct flowi *fl, unsigned short family) 1267{ 1268 switch (family){ 1269 case AF_INET: 1270 return (xfrm_address_t *)&fl->u.ip4.daddr; 1271 case AF_INET6: 1272 return (xfrm_address_t *)&fl->u.ip6.daddr; 1273 } 1274 return NULL; 1275} 1276 1277static __inline__ 1278xfrm_address_t *xfrm_flowi_saddr(const struct flowi *fl, unsigned short family) 1279{ 1280 switch (family){ 1281 case AF_INET: 1282 return (xfrm_address_t *)&fl->u.ip4.saddr; 1283 case AF_INET6: 1284 return (xfrm_address_t *)&fl->u.ip6.saddr; 1285 } 1286 return NULL; 1287} 1288 1289static __inline__ 1290void xfrm_flowi_addr_get(const struct flowi *fl, 1291 xfrm_address_t *saddr, xfrm_address_t *daddr, 1292 unsigned short family) 1293{ 1294 switch(family) { 1295 case AF_INET: 1296 memcpy(&saddr->a4, &fl->u.ip4.saddr, sizeof(saddr->a4)); 1297 memcpy(&daddr->a4, &fl->u.ip4.daddr, sizeof(daddr->a4)); 1298 break; 1299 case AF_INET6: 1300 saddr->in6 = fl->u.ip6.saddr; 1301 daddr->in6 = fl->u.ip6.daddr; 1302 break; 1303 } 1304} 1305 1306static __inline__ int 1307__xfrm4_state_addr_check(const struct xfrm_state *x, 1308 const xfrm_address_t *daddr, const xfrm_address_t *saddr) 1309{ 1310 if (daddr->a4 == x->id.daddr.a4 && 1311 (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4)) 1312 return 1; 1313 return 0; 1314} 1315 1316static __inline__ int 1317__xfrm6_state_addr_check(const struct xfrm_state *x, 1318 const xfrm_address_t *daddr, const xfrm_address_t *saddr) 1319{ 1320 if (ipv6_addr_equal((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) && 1321 (ipv6_addr_equal((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr) || 1322 ipv6_addr_any((struct in6_addr *)saddr) || 1323 ipv6_addr_any((struct in6_addr *)&x->props.saddr))) 1324 return 1; 1325 return 0; 1326} 1327 1328static __inline__ int 1329xfrm_state_addr_check(const struct xfrm_state *x, 1330 const xfrm_address_t *daddr, const xfrm_address_t *saddr, 1331 unsigned short family) 1332{ 1333 switch (family) { 1334 case AF_INET: 1335 return __xfrm4_state_addr_check(x, daddr, saddr); 1336 case AF_INET6: 1337 return __xfrm6_state_addr_check(x, daddr, saddr); 1338 } 1339 return 0; 1340} 1341 1342static __inline__ int 1343xfrm_state_addr_flow_check(const struct xfrm_state *x, const struct flowi *fl, 1344 unsigned short family) 1345{ 1346 switch (family) { 1347 case AF_INET: 1348 return __xfrm4_state_addr_check(x, 1349 (const xfrm_address_t *)&fl->u.ip4.daddr, 1350 (const xfrm_address_t *)&fl->u.ip4.saddr); 1351 case AF_INET6: 1352 return __xfrm6_state_addr_check(x, 1353 (const xfrm_address_t *)&fl->u.ip6.daddr, 1354 (const xfrm_address_t *)&fl->u.ip6.saddr); 1355 } 1356 return 0; 1357} 1358 1359static inline int xfrm_state_kern(const struct xfrm_state *x) 1360{ 1361 return atomic_read(&x->tunnel_users); 1362} 1363 1364static inline bool xfrm_id_proto_valid(u8 proto) 1365{ 1366 switch (proto) { 1367 case IPPROTO_AH: 1368 case IPPROTO_ESP: 1369 case IPPROTO_COMP: 1370#if IS_ENABLED(CONFIG_IPV6) 1371 case IPPROTO_ROUTING: 1372 case IPPROTO_DSTOPTS: 1373#endif 1374 return true; 1375 default: 1376 return false; 1377 } 1378} 1379 1380/* IPSEC_PROTO_ANY only matches 3 IPsec protocols, 0 could match all. */ 1381static inline int xfrm_id_proto_match(u8 proto, u8 userproto) 1382{ 1383 return (!userproto || proto == userproto || 1384 (userproto == IPSEC_PROTO_ANY && (proto == IPPROTO_AH || 1385 proto == IPPROTO_ESP || 1386 proto == IPPROTO_COMP))); 1387} 1388 1389/* 1390 * xfrm algorithm information 1391 */ 1392struct xfrm_algo_aead_info { 1393 char *geniv; 1394 u16 icv_truncbits; 1395}; 1396 1397struct xfrm_algo_auth_info { 1398 u16 icv_truncbits; 1399 u16 icv_fullbits; 1400}; 1401 1402struct xfrm_algo_encr_info { 1403 char *geniv; 1404 u16 blockbits; 1405 u16 defkeybits; 1406}; 1407 1408struct xfrm_algo_comp_info { 1409 u16 threshold; 1410}; 1411 1412struct xfrm_algo_desc { 1413 char *name; 1414 char *compat; 1415 u8 available:1; 1416 u8 pfkey_supported:1; 1417 union { 1418 struct xfrm_algo_aead_info aead; 1419 struct xfrm_algo_auth_info auth; 1420 struct xfrm_algo_encr_info encr; 1421 struct xfrm_algo_comp_info comp; 1422 } uinfo; 1423 struct sadb_alg desc; 1424}; 1425 1426/* XFRM protocol handlers. */ 1427struct xfrm4_protocol { 1428 int (*handler)(struct sk_buff *skb); 1429 int (*input_handler)(struct sk_buff *skb, int nexthdr, __be32 spi, 1430 int encap_type); 1431 int (*cb_handler)(struct sk_buff *skb, int err); 1432 int (*err_handler)(struct sk_buff *skb, u32 info); 1433 1434 struct xfrm4_protocol __rcu *next; 1435 int priority; 1436}; 1437 1438struct xfrm6_protocol { 1439 int (*handler)(struct sk_buff *skb); 1440 int (*input_handler)(struct sk_buff *skb, int nexthdr, __be32 spi, 1441 int encap_type); 1442 int (*cb_handler)(struct sk_buff *skb, int err); 1443 int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt, 1444 u8 type, u8 code, int offset, __be32 info); 1445 1446 struct xfrm6_protocol __rcu *next; 1447 int priority; 1448}; 1449 1450/* XFRM tunnel handlers. */ 1451struct xfrm_tunnel { 1452 int (*handler)(struct sk_buff *skb); 1453 int (*cb_handler)(struct sk_buff *skb, int err); 1454 int (*err_handler)(struct sk_buff *skb, u32 info); 1455 1456 struct xfrm_tunnel __rcu *next; 1457 int priority; 1458}; 1459 1460struct xfrm6_tunnel { 1461 int (*handler)(struct sk_buff *skb); 1462 int (*cb_handler)(struct sk_buff *skb, int err); 1463 int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt, 1464 u8 type, u8 code, int offset, __be32 info); 1465 struct xfrm6_tunnel __rcu *next; 1466 int priority; 1467}; 1468 1469void xfrm_init(void); 1470void xfrm4_init(void); 1471int xfrm_state_init(struct net *net); 1472void xfrm_state_fini(struct net *net); 1473void xfrm4_state_init(void); 1474void xfrm4_protocol_init(void); 1475#ifdef CONFIG_XFRM 1476int xfrm6_init(void); 1477void xfrm6_fini(void); 1478int xfrm6_state_init(void); 1479void xfrm6_state_fini(void); 1480int xfrm6_protocol_init(void); 1481void xfrm6_protocol_fini(void); 1482#else 1483static inline int xfrm6_init(void) 1484{ 1485 return 0; 1486} 1487static inline void xfrm6_fini(void) 1488{ 1489 ; 1490} 1491#endif 1492 1493#ifdef CONFIG_XFRM_STATISTICS 1494int xfrm_proc_init(struct net *net); 1495void xfrm_proc_fini(struct net *net); 1496#endif 1497 1498int xfrm_sysctl_init(struct net *net); 1499#ifdef CONFIG_SYSCTL 1500void xfrm_sysctl_fini(struct net *net); 1501#else 1502static inline void xfrm_sysctl_fini(struct net *net) 1503{ 1504} 1505#endif 1506 1507void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto, 1508 struct xfrm_address_filter *filter); 1509int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk, 1510 int (*func)(struct xfrm_state *, int, void*), void *); 1511void xfrm_state_walk_done(struct xfrm_state_walk *walk, struct net *net); 1512struct xfrm_state *xfrm_state_alloc(struct net *net); 1513void xfrm_state_free(struct xfrm_state *x); 1514struct xfrm_state *xfrm_state_find(const xfrm_address_t *daddr, 1515 const xfrm_address_t *saddr, 1516 const struct flowi *fl, 1517 struct xfrm_tmpl *tmpl, 1518 struct xfrm_policy *pol, int *err, 1519 unsigned short family, u32 if_id); 1520struct xfrm_state *xfrm_stateonly_find(struct net *net, u32 mark, u32 if_id, 1521 xfrm_address_t *daddr, 1522 xfrm_address_t *saddr, 1523 unsigned short family, 1524 u8 mode, u8 proto, u32 reqid); 1525struct xfrm_state *xfrm_state_lookup_byspi(struct net *net, __be32 spi, 1526 unsigned short family); 1527int xfrm_state_check_expire(struct xfrm_state *x); 1528void xfrm_state_insert(struct xfrm_state *x); 1529int xfrm_state_add(struct xfrm_state *x); 1530int xfrm_state_update(struct xfrm_state *x); 1531struct xfrm_state *xfrm_state_lookup(struct net *net, u32 mark, 1532 const xfrm_address_t *daddr, __be32 spi, 1533 u8 proto, unsigned short family); 1534struct xfrm_state *xfrm_state_lookup_byaddr(struct net *net, u32 mark, 1535 const xfrm_address_t *daddr, 1536 const xfrm_address_t *saddr, 1537 u8 proto, 1538 unsigned short family); 1539#ifdef CONFIG_XFRM_SUB_POLICY 1540void xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n, 1541 unsigned short family); 1542void xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n, 1543 unsigned short family); 1544#else 1545static inline void xfrm_tmpl_sort(struct xfrm_tmpl **d, struct xfrm_tmpl **s, 1546 int n, unsigned short family) 1547{ 1548} 1549 1550static inline void xfrm_state_sort(struct xfrm_state **d, struct xfrm_state **s, 1551 int n, unsigned short family) 1552{ 1553} 1554#endif 1555 1556struct xfrmk_sadinfo { 1557 u32 sadhcnt; /* current hash bkts */ 1558 u32 sadhmcnt; /* max allowed hash bkts */ 1559 u32 sadcnt; /* current running count */ 1560}; 1561 1562struct xfrmk_spdinfo { 1563 u32 incnt; 1564 u32 outcnt; 1565 u32 fwdcnt; 1566 u32 inscnt; 1567 u32 outscnt; 1568 u32 fwdscnt; 1569 u32 spdhcnt; 1570 u32 spdhmcnt; 1571}; 1572 1573struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq); 1574int xfrm_state_delete(struct xfrm_state *x); 1575int xfrm_state_flush(struct net *net, u8 proto, bool task_valid, bool sync); 1576int xfrm_dev_state_flush(struct net *net, struct net_device *dev, bool task_valid); 1577void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si); 1578void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si); 1579u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq); 1580int xfrm_init_replay(struct xfrm_state *x); 1581u32 xfrm_state_mtu(struct xfrm_state *x, int mtu); 1582int __xfrm_init_state(struct xfrm_state *x, bool init_replay, bool offload); 1583int xfrm_init_state(struct xfrm_state *x); 1584int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type); 1585int xfrm_input_resume(struct sk_buff *skb, int nexthdr); 1586int xfrm_trans_queue_net(struct net *net, struct sk_buff *skb, 1587 int (*finish)(struct net *, struct sock *, 1588 struct sk_buff *)); 1589int xfrm_trans_queue(struct sk_buff *skb, 1590 int (*finish)(struct net *, struct sock *, 1591 struct sk_buff *)); 1592int xfrm_output_resume(struct sock *sk, struct sk_buff *skb, int err); 1593int xfrm_output(struct sock *sk, struct sk_buff *skb); 1594 1595#if IS_ENABLED(CONFIG_NET_PKTGEN) 1596int pktgen_xfrm_outer_mode_output(struct xfrm_state *x, struct sk_buff *skb); 1597#endif 1598 1599void xfrm_local_error(struct sk_buff *skb, int mtu); 1600int xfrm4_extract_input(struct xfrm_state *x, struct sk_buff *skb); 1601int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi, 1602 int encap_type); 1603int xfrm4_transport_finish(struct sk_buff *skb, int async); 1604int xfrm4_rcv(struct sk_buff *skb); 1605int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq); 1606 1607static inline int xfrm4_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi) 1608{ 1609 XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL; 1610 XFRM_SPI_SKB_CB(skb)->family = AF_INET; 1611 XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr); 1612 return xfrm_input(skb, nexthdr, spi, 0); 1613} 1614 1615int xfrm4_output(struct net *net, struct sock *sk, struct sk_buff *skb); 1616int xfrm4_output_finish(struct sock *sk, struct sk_buff *skb); 1617int xfrm4_protocol_register(struct xfrm4_protocol *handler, unsigned char protocol); 1618int xfrm4_protocol_deregister(struct xfrm4_protocol *handler, unsigned char protocol); 1619int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family); 1620int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family); 1621void xfrm4_local_error(struct sk_buff *skb, u32 mtu); 1622int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb); 1623int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi, 1624 struct ip6_tnl *t); 1625int xfrm6_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi, 1626 int encap_type); 1627int xfrm6_transport_finish(struct sk_buff *skb, int async); 1628int xfrm6_rcv_tnl(struct sk_buff *skb, struct ip6_tnl *t); 1629int xfrm6_rcv(struct sk_buff *skb); 1630int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr, 1631 xfrm_address_t *saddr, u8 proto); 1632void xfrm6_local_error(struct sk_buff *skb, u32 mtu); 1633int xfrm6_protocol_register(struct xfrm6_protocol *handler, unsigned char protocol); 1634int xfrm6_protocol_deregister(struct xfrm6_protocol *handler, unsigned char protocol); 1635int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family); 1636int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family); 1637__be32 xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr); 1638__be32 xfrm6_tunnel_spi_lookup(struct net *net, const xfrm_address_t *saddr); 1639int xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb); 1640int xfrm6_output_finish(struct sock *sk, struct sk_buff *skb); 1641int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb, 1642 u8 **prevhdr); 1643 1644#ifdef CONFIG_XFRM 1645void xfrm6_local_rxpmtu(struct sk_buff *skb, u32 mtu); 1646int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb); 1647int xfrm6_udp_encap_rcv(struct sock *sk, struct sk_buff *skb); 1648int xfrm_user_policy(struct sock *sk, int optname, sockptr_t optval, 1649 int optlen); 1650#else 1651static inline int xfrm_user_policy(struct sock *sk, int optname, 1652 sockptr_t optval, int optlen) 1653{ 1654 return -ENOPROTOOPT; 1655} 1656#endif 1657 1658struct dst_entry *__xfrm_dst_lookup(struct net *net, int tos, int oif, 1659 const xfrm_address_t *saddr, 1660 const xfrm_address_t *daddr, 1661 int family, u32 mark); 1662 1663struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp); 1664 1665void xfrm_policy_walk_init(struct xfrm_policy_walk *walk, u8 type); 1666int xfrm_policy_walk(struct net *net, struct xfrm_policy_walk *walk, 1667 int (*func)(struct xfrm_policy *, int, int, void*), 1668 void *); 1669void xfrm_policy_walk_done(struct xfrm_policy_walk *walk, struct net *net); 1670int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl); 1671struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, 1672 const struct xfrm_mark *mark, 1673 u32 if_id, u8 type, int dir, 1674 struct xfrm_selector *sel, 1675 struct xfrm_sec_ctx *ctx, int delete, 1676 int *err); 1677struct xfrm_policy *xfrm_policy_byid(struct net *net, 1678 const struct xfrm_mark *mark, u32 if_id, 1679 u8 type, int dir, u32 id, int delete, 1680 int *err); 1681int xfrm_policy_flush(struct net *net, u8 type, bool task_valid); 1682void xfrm_policy_hash_rebuild(struct net *net); 1683u32 xfrm_get_acqseq(void); 1684int verify_spi_info(u8 proto, u32 min, u32 max); 1685int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi); 1686struct xfrm_state *xfrm_find_acq(struct net *net, const struct xfrm_mark *mark, 1687 u8 mode, u32 reqid, u32 if_id, u8 proto, 1688 const xfrm_address_t *daddr, 1689 const xfrm_address_t *saddr, int create, 1690 unsigned short family); 1691int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol); 1692 1693#ifdef CONFIG_XFRM_MIGRATE 1694int km_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, 1695 const struct xfrm_migrate *m, int num_bundles, 1696 const struct xfrm_kmaddress *k, 1697 const struct xfrm_encap_tmpl *encap); 1698struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net, 1699 u32 if_id); 1700struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x, 1701 struct xfrm_migrate *m, 1702 struct xfrm_encap_tmpl *encap); 1703int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, 1704 struct xfrm_migrate *m, int num_bundles, 1705 struct xfrm_kmaddress *k, struct net *net, 1706 struct xfrm_encap_tmpl *encap, u32 if_id); 1707#endif 1708 1709int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport); 1710void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 portid); 1711int km_report(struct net *net, u8 proto, struct xfrm_selector *sel, 1712 xfrm_address_t *addr); 1713 1714void xfrm_input_init(void); 1715int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq); 1716 1717void xfrm_probe_algs(void); 1718int xfrm_count_pfkey_auth_supported(void); 1719int xfrm_count_pfkey_enc_supported(void); 1720struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx); 1721struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx); 1722struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id); 1723struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id); 1724struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id); 1725struct xfrm_algo_desc *xfrm_aalg_get_byname(const char *name, int probe); 1726struct xfrm_algo_desc *xfrm_ealg_get_byname(const char *name, int probe); 1727struct xfrm_algo_desc *xfrm_calg_get_byname(const char *name, int probe); 1728struct xfrm_algo_desc *xfrm_aead_get_byname(const char *name, int icv_len, 1729 int probe); 1730 1731static inline bool xfrm6_addr_equal(const xfrm_address_t *a, 1732 const xfrm_address_t *b) 1733{ 1734 return ipv6_addr_equal((const struct in6_addr *)a, 1735 (const struct in6_addr *)b); 1736} 1737 1738static inline bool xfrm_addr_equal(const xfrm_address_t *a, 1739 const xfrm_address_t *b, 1740 sa_family_t family) 1741{ 1742 switch (family) { 1743 default: 1744 case AF_INET: 1745 return ((__force u32)a->a4 ^ (__force u32)b->a4) == 0; 1746 case AF_INET6: 1747 return xfrm6_addr_equal(a, b); 1748 } 1749} 1750 1751static inline int xfrm_policy_id2dir(u32 index) 1752{ 1753 return index & 7; 1754} 1755 1756#ifdef CONFIG_XFRM 1757static inline int xfrm_aevent_is_on(struct net *net) 1758{ 1759 struct sock *nlsk; 1760 int ret = 0; 1761 1762 rcu_read_lock(); 1763 nlsk = rcu_dereference(net->xfrm.nlsk); 1764 if (nlsk) 1765 ret = netlink_has_listeners(nlsk, XFRMNLGRP_AEVENTS); 1766 rcu_read_unlock(); 1767 return ret; 1768} 1769 1770static inline int xfrm_acquire_is_on(struct net *net) 1771{ 1772 struct sock *nlsk; 1773 int ret = 0; 1774 1775 rcu_read_lock(); 1776 nlsk = rcu_dereference(net->xfrm.nlsk); 1777 if (nlsk) 1778 ret = netlink_has_listeners(nlsk, XFRMNLGRP_ACQUIRE); 1779 rcu_read_unlock(); 1780 1781 return ret; 1782} 1783#endif 1784 1785static inline unsigned int aead_len(struct xfrm_algo_aead *alg) 1786{ 1787 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8); 1788} 1789 1790static inline unsigned int xfrm_alg_len(const struct xfrm_algo *alg) 1791{ 1792 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8); 1793} 1794 1795static inline unsigned int xfrm_alg_auth_len(const struct xfrm_algo_auth *alg) 1796{ 1797 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8); 1798} 1799 1800static inline unsigned int xfrm_replay_state_esn_len(struct xfrm_replay_state_esn *replay_esn) 1801{ 1802 return sizeof(*replay_esn) + replay_esn->bmp_len * sizeof(__u32); 1803} 1804 1805#ifdef CONFIG_XFRM_MIGRATE 1806static inline int xfrm_replay_clone(struct xfrm_state *x, 1807 struct xfrm_state *orig) 1808{ 1809 1810 x->replay_esn = kmemdup(orig->replay_esn, 1811 xfrm_replay_state_esn_len(orig->replay_esn), 1812 GFP_KERNEL); 1813 if (!x->replay_esn) 1814 return -ENOMEM; 1815 x->preplay_esn = kmemdup(orig->preplay_esn, 1816 xfrm_replay_state_esn_len(orig->preplay_esn), 1817 GFP_KERNEL); 1818 if (!x->preplay_esn) 1819 return -ENOMEM; 1820 1821 return 0; 1822} 1823 1824static inline struct xfrm_algo_aead *xfrm_algo_aead_clone(struct xfrm_algo_aead *orig) 1825{ 1826 return kmemdup(orig, aead_len(orig), GFP_KERNEL); 1827} 1828 1829 1830static inline struct xfrm_algo *xfrm_algo_clone(struct xfrm_algo *orig) 1831{ 1832 return kmemdup(orig, xfrm_alg_len(orig), GFP_KERNEL); 1833} 1834 1835static inline struct xfrm_algo_auth *xfrm_algo_auth_clone(struct xfrm_algo_auth *orig) 1836{ 1837 return kmemdup(orig, xfrm_alg_auth_len(orig), GFP_KERNEL); 1838} 1839 1840static inline void xfrm_states_put(struct xfrm_state **states, int n) 1841{ 1842 int i; 1843 for (i = 0; i < n; i++) 1844 xfrm_state_put(*(states + i)); 1845} 1846 1847static inline void xfrm_states_delete(struct xfrm_state **states, int n) 1848{ 1849 int i; 1850 for (i = 0; i < n; i++) 1851 xfrm_state_delete(*(states + i)); 1852} 1853#endif 1854 1855#ifdef CONFIG_XFRM 1856static inline struct xfrm_state *xfrm_input_state(struct sk_buff *skb) 1857{ 1858 struct sec_path *sp = skb_sec_path(skb); 1859 1860 return sp->xvec[sp->len - 1]; 1861} 1862#endif 1863 1864static inline struct xfrm_offload *xfrm_offload(struct sk_buff *skb) 1865{ 1866#ifdef CONFIG_XFRM 1867 struct sec_path *sp = skb_sec_path(skb); 1868 1869 if (!sp || !sp->olen || sp->len != sp->olen) 1870 return NULL; 1871 1872 return &sp->ovec[sp->olen - 1]; 1873#else 1874 return NULL; 1875#endif 1876} 1877 1878void __init xfrm_dev_init(void); 1879 1880#ifdef CONFIG_XFRM_OFFLOAD 1881void xfrm_dev_resume(struct sk_buff *skb); 1882void xfrm_dev_backlog(struct softnet_data *sd); 1883struct sk_buff *validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t features, bool *again); 1884int xfrm_dev_state_add(struct net *net, struct xfrm_state *x, 1885 struct xfrm_user_offload *xuo); 1886bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x); 1887 1888static inline void xfrm_dev_state_advance_esn(struct xfrm_state *x) 1889{ 1890 struct xfrm_state_offload *xso = &x->xso; 1891 1892 if (xso->dev && xso->dev->xfrmdev_ops->xdo_dev_state_advance_esn) 1893 xso->dev->xfrmdev_ops->xdo_dev_state_advance_esn(x); 1894} 1895 1896static inline bool xfrm_dst_offload_ok(struct dst_entry *dst) 1897{ 1898 struct xfrm_state *x = dst->xfrm; 1899 struct xfrm_dst *xdst; 1900 1901 if (!x || !x->type_offload) 1902 return false; 1903 1904 xdst = (struct xfrm_dst *) dst; 1905 if (!x->xso.offload_handle && !xdst->child->xfrm) 1906 return true; 1907 if (x->xso.offload_handle && (x->xso.dev == xfrm_dst_path(dst)->dev) && 1908 !xdst->child->xfrm) 1909 return true; 1910 1911 return false; 1912} 1913 1914static inline void xfrm_dev_state_delete(struct xfrm_state *x) 1915{ 1916 struct xfrm_state_offload *xso = &x->xso; 1917 1918 if (xso->dev) 1919 xso->dev->xfrmdev_ops->xdo_dev_state_delete(x); 1920} 1921 1922static inline void xfrm_dev_state_free(struct xfrm_state *x) 1923{ 1924 struct xfrm_state_offload *xso = &x->xso; 1925 struct net_device *dev = xso->dev; 1926 1927 if (dev && dev->xfrmdev_ops) { 1928 if (dev->xfrmdev_ops->xdo_dev_state_free) 1929 dev->xfrmdev_ops->xdo_dev_state_free(x); 1930 xso->dev = NULL; 1931 dev_put(dev); 1932 } 1933} 1934#else 1935static inline void xfrm_dev_resume(struct sk_buff *skb) 1936{ 1937} 1938 1939static inline void xfrm_dev_backlog(struct softnet_data *sd) 1940{ 1941} 1942 1943static inline struct sk_buff *validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t features, bool *again) 1944{ 1945 return skb; 1946} 1947 1948static inline int xfrm_dev_state_add(struct net *net, struct xfrm_state *x, struct xfrm_user_offload *xuo) 1949{ 1950 return 0; 1951} 1952 1953static inline void xfrm_dev_state_delete(struct xfrm_state *x) 1954{ 1955} 1956 1957static inline void xfrm_dev_state_free(struct xfrm_state *x) 1958{ 1959} 1960 1961static inline bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x) 1962{ 1963 return false; 1964} 1965 1966static inline void xfrm_dev_state_advance_esn(struct xfrm_state *x) 1967{ 1968} 1969 1970static inline bool xfrm_dst_offload_ok(struct dst_entry *dst) 1971{ 1972 return false; 1973} 1974#endif 1975 1976static inline int xfrm_mark_get(struct nlattr **attrs, struct xfrm_mark *m) 1977{ 1978 if (attrs[XFRMA_MARK]) 1979 memcpy(m, nla_data(attrs[XFRMA_MARK]), sizeof(struct xfrm_mark)); 1980 else 1981 m->v = m->m = 0; 1982 1983 return m->v & m->m; 1984} 1985 1986static inline int xfrm_mark_put(struct sk_buff *skb, const struct xfrm_mark *m) 1987{ 1988 int ret = 0; 1989 1990 if (m->m | m->v) 1991 ret = nla_put(skb, XFRMA_MARK, sizeof(struct xfrm_mark), m); 1992 return ret; 1993} 1994 1995static inline __u32 xfrm_smark_get(__u32 mark, struct xfrm_state *x) 1996{ 1997 struct xfrm_mark *m = &x->props.smark; 1998 1999 return (m->v & m->m) | (mark & ~m->m); 2000} 2001 2002static inline int xfrm_if_id_put(struct sk_buff *skb, __u32 if_id) 2003{ 2004 int ret = 0; 2005 2006 if (if_id) 2007 ret = nla_put_u32(skb, XFRMA_IF_ID, if_id); 2008 return ret; 2009} 2010 2011static inline int xfrm_tunnel_check(struct sk_buff *skb, struct xfrm_state *x, 2012 unsigned int family) 2013{ 2014 bool tunnel = false; 2015 2016 switch(family) { 2017 case AF_INET: 2018 if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4) 2019 tunnel = true; 2020 break; 2021 case AF_INET6: 2022 if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6) 2023 tunnel = true; 2024 break; 2025 } 2026 if (tunnel && !(x->outer_mode.flags & XFRM_MODE_FLAG_TUNNEL)) 2027 return -EINVAL; 2028 2029 return 0; 2030} 2031 2032extern const int xfrm_msg_min[XFRM_NR_MSGTYPES]; 2033extern const struct nla_policy xfrma_policy[XFRMA_MAX+1]; 2034 2035struct xfrm_translator { 2036 /* Allocate frag_list and put compat translation there */ 2037 int (*alloc_compat)(struct sk_buff *skb, const struct nlmsghdr *src); 2038 2039 /* Allocate nlmsg with 64-bit translaton of received 32-bit message */ 2040 struct nlmsghdr *(*rcv_msg_compat)(const struct nlmsghdr *nlh, 2041 int maxtype, const struct nla_policy *policy, 2042 struct netlink_ext_ack *extack); 2043 2044 /* Translate 32-bit user_policy from sockptr */ 2045 int (*xlate_user_policy_sockptr)(u8 **pdata32, int optlen); 2046 2047 struct module *owner; 2048}; 2049 2050#if IS_ENABLED(CONFIG_XFRM_USER_COMPAT) 2051extern int xfrm_register_translator(struct xfrm_translator *xtr); 2052extern int xfrm_unregister_translator(struct xfrm_translator *xtr); 2053extern struct xfrm_translator *xfrm_get_translator(void); 2054extern void xfrm_put_translator(struct xfrm_translator *xtr); 2055#else 2056static inline struct xfrm_translator *xfrm_get_translator(void) 2057{ 2058 return NULL; 2059} 2060static inline void xfrm_put_translator(struct xfrm_translator *xtr) 2061{ 2062} 2063#endif 2064 2065#if IS_ENABLED(CONFIG_IPV6) 2066static inline bool xfrm6_local_dontfrag(const struct sock *sk) 2067{ 2068 int proto; 2069 2070 if (!sk || sk->sk_family != AF_INET6) 2071 return false; 2072 2073 proto = sk->sk_protocol; 2074 if (proto == IPPROTO_UDP || proto == IPPROTO_RAW) 2075 return inet6_sk(sk)->dontfrag; 2076 2077 return false; 2078} 2079#endif 2080#endif /* _NET_XFRM_H */ 2081