FILE
xfrm.h
File preview with syntax highlighting.
linux-6.19.14/include/net/xfrm.h
1/* SPDX-License-Identifier: GPL-2.0 */ 2#ifndef _NET_XFRM_H 3#define _NET_XFRM_H 4 5#include <linux/compiler.h> 6#include <linux/xfrm.h> 7#include <linux/spinlock.h> 8#include <linux/list.h> 9#include <linux/skbuff.h> 10#include <linux/socket.h> 11#include <linux/pfkeyv2.h> 12#include <linux/ipsec.h> 13#include <linux/in6.h> 14#include <linux/mutex.h> 15#include <linux/audit.h> 16#include <linux/slab.h> 17#include <linux/refcount.h> 18#include <linux/sockptr.h> 19 20#include <net/sock.h> 21#include <net/dst.h> 22#include <net/inet_dscp.h> 23#include <net/ip.h> 24#include <net/route.h> 25#include <net/ipv6.h> 26#include <net/ip6_fib.h> 27#include <net/flow.h> 28#include <net/gro_cells.h> 29 30#include <linux/interrupt.h> 31 32#ifdef CONFIG_XFRM_STATISTICS 33#include <net/snmp.h> 34#endif 35 36#define XFRM_PROTO_ESP 50 37#define XFRM_PROTO_AH 51 38#define XFRM_PROTO_COMP 108 39#define XFRM_PROTO_IPIP 4 40#define XFRM_PROTO_IPV6 41 41#define XFRM_PROTO_IPTFS IPPROTO_AGGFRAG 42#define XFRM_PROTO_ROUTING IPPROTO_ROUTING 43#define XFRM_PROTO_DSTOPTS IPPROTO_DSTOPTS 44 45#define XFRM_ALIGN4(len) (((len) + 3) & ~3) 46#define XFRM_ALIGN8(len) (((len) + 7) & ~7) 47#define MODULE_ALIAS_XFRM_MODE(family, encap) \ 48 MODULE_ALIAS("xfrm-mode-" __stringify(family) "-" __stringify(encap)) 49#define MODULE_ALIAS_XFRM_TYPE(family, proto) \ 50 MODULE_ALIAS("xfrm-type-" __stringify(family) "-" __stringify(proto)) 51#define MODULE_ALIAS_XFRM_OFFLOAD_TYPE(family, proto) \ 52 MODULE_ALIAS("xfrm-offload-" __stringify(family) "-" __stringify(proto)) 53 54#ifdef CONFIG_XFRM_STATISTICS 55#define XFRM_INC_STATS(net, field) SNMP_INC_STATS((net)->mib.xfrm_statistics, field) 56#define XFRM_ADD_STATS(net, field, val) SNMP_ADD_STATS((net)->mib.xfrm_statistics, field, val) 57#else 58#define XFRM_INC_STATS(net, field) ((void)(net)) 59#define XFRM_ADD_STATS(net, field, val) ((void)(net)) 60#endif 61 62 63/* Organization of SPD aka "XFRM rules" 64 ------------------------------------ 65 66 Basic objects: 67 - policy rule, struct xfrm_policy (=SPD entry) 68 - bundle of transformations, struct dst_entry == struct xfrm_dst (=SA bundle) 69 - instance of a transformer, struct xfrm_state (=SA) 70 - template to clone xfrm_state, struct xfrm_tmpl 71 72 SPD is organized as hash table (for policies that meet minimum address prefix 73 length setting, net->xfrm.policy_hthresh). Other policies are stored in 74 lists, sorted into rbtree ordered by destination and source address networks. 75 See net/xfrm/xfrm_policy.c for details. 76 77 (To be compatible with existing pfkeyv2 implementations, 78 many rules with priority of 0x7fffffff are allowed to exist and 79 such rules are ordered in an unpredictable way, thanks to bsd folks.) 80 81 If "action" is "block", then we prohibit the flow, otherwise: 82 if "xfrms_nr" is zero, the flow passes untransformed. Otherwise, 83 policy entry has list of up to XFRM_MAX_DEPTH transformations, 84 described by templates xfrm_tmpl. Each template is resolved 85 to a complete xfrm_state (see below) and we pack bundle of transformations 86 to a dst_entry returned to requester. 87 88 dst -. xfrm .-> xfrm_state #1 89 |---. child .-> dst -. xfrm .-> xfrm_state #2 90 |---. child .-> dst -. xfrm .-> xfrm_state #3 91 |---. child .-> NULL 92 93 94 Resolution of xrfm_tmpl 95 ----------------------- 96 Template contains: 97 1. ->mode Mode: transport or tunnel 98 2. ->id.proto Protocol: AH/ESP/IPCOMP 99 3. ->id.daddr Remote tunnel endpoint, ignored for transport mode. 100 Q: allow to resolve security gateway? 101 4. ->id.spi If not zero, static SPI. 102 5. ->saddr Local tunnel endpoint, ignored for transport mode. 103 6. ->algos List of allowed algos. Plain bitmask now. 104 Q: ealgos, aalgos, calgos. What a mess... 105 7. ->share Sharing mode. 106 Q: how to implement private sharing mode? To add struct sock* to 107 flow id? 108 109 Having this template we search through SAD searching for entries 110 with appropriate mode/proto/algo, permitted by selector. 111 If no appropriate entry found, it is requested from key manager. 112 113 PROBLEMS: 114 Q: How to find all the bundles referring to a physical path for 115 PMTU discovery? Seems, dst should contain list of all parents... 116 and enter to infinite locking hierarchy disaster. 117 No! It is easier, we will not search for them, let them find us. 118 We add genid to each dst plus pointer to genid of raw IP route, 119 pmtu disc will update pmtu on raw IP route and increase its genid. 120 dst_check() will see this for top level and trigger resyncing 121 metrics. Plus, it will be made via sk->sk_dst_cache. Solved. 122 */ 123 124struct xfrm_state_walk { 125 struct list_head all; 126 u8 state; 127 u8 dying; 128 u8 proto; 129 u32 seq; 130 struct xfrm_address_filter *filter; 131}; 132 133enum { 134 XFRM_DEV_OFFLOAD_IN = 1, 135 XFRM_DEV_OFFLOAD_OUT, 136 XFRM_DEV_OFFLOAD_FWD, 137}; 138 139enum { 140 XFRM_DEV_OFFLOAD_UNSPECIFIED, 141 XFRM_DEV_OFFLOAD_CRYPTO, 142 XFRM_DEV_OFFLOAD_PACKET, 143}; 144 145enum { 146 XFRM_DEV_OFFLOAD_FLAG_ACQ = 1, 147}; 148 149struct xfrm_dev_offload { 150 /* The device for this offload. 151 * Device drivers should not use this directly, as that will prevent 152 * them from working with bonding device. Instead, the device passed 153 * to the add/delete callbacks should be used. 154 */ 155 struct net_device *dev; 156 netdevice_tracker dev_tracker; 157 /* This is a private pointer used by the bonding driver (and eventually 158 * should be moved there). Device drivers should not use it. 159 * Protected by xfrm_state.lock AND bond.ipsec_lock in most cases, 160 * except in the .xdo_dev_state_del() flow, where only xfrm_state.lock 161 * is held. 162 */ 163 struct net_device *real_dev; 164 unsigned long offload_handle; 165 u8 dir : 2; 166 u8 type : 2; 167 u8 flags : 2; 168}; 169 170struct xfrm_mode { 171 u8 encap; 172 u8 family; 173 u8 flags; 174}; 175 176/* Flags for xfrm_mode. */ 177enum { 178 XFRM_MODE_FLAG_TUNNEL = 1, 179}; 180 181enum xfrm_replay_mode { 182 XFRM_REPLAY_MODE_LEGACY, 183 XFRM_REPLAY_MODE_BMP, 184 XFRM_REPLAY_MODE_ESN, 185}; 186 187/* Full description of state of transformer. */ 188struct xfrm_state { 189 possible_net_t xs_net; 190 union { 191 struct hlist_node gclist; 192 struct hlist_node bydst; 193 }; 194 union { 195 struct hlist_node dev_gclist; 196 struct hlist_node bysrc; 197 }; 198 struct hlist_node byspi; 199 struct hlist_node byseq; 200 struct hlist_node state_cache; 201 struct hlist_node state_cache_input; 202 203 refcount_t refcnt; 204 spinlock_t lock; 205 206 u32 pcpu_num; 207 struct xfrm_id id; 208 struct xfrm_selector sel; 209 struct xfrm_mark mark; 210 u32 if_id; 211 u32 tfcpad; 212 213 u32 genid; 214 215 /* Key manager bits */ 216 struct xfrm_state_walk km; 217 218 /* Parameters of this state. */ 219 struct { 220 u32 reqid; 221 u8 mode; 222 u8 replay_window; 223 u8 aalgo, ealgo, calgo; 224 u8 flags; 225 u16 family; 226 xfrm_address_t saddr; 227 int header_len; 228 int enc_hdr_len; 229 int trailer_len; 230 u32 extra_flags; 231 struct xfrm_mark smark; 232 } props; 233 234 struct xfrm_lifetime_cfg lft; 235 236 /* Data for transformer */ 237 struct xfrm_algo_auth *aalg; 238 struct xfrm_algo *ealg; 239 struct xfrm_algo *calg; 240 struct xfrm_algo_aead *aead; 241 const char *geniv; 242 243 /* mapping change rate limiting */ 244 __be16 new_mapping_sport; 245 u32 new_mapping; /* seconds */ 246 u32 mapping_maxage; /* seconds for input SA */ 247 248 /* Data for encapsulator */ 249 struct xfrm_encap_tmpl *encap; 250 251 /* NAT keepalive */ 252 u32 nat_keepalive_interval; /* seconds */ 253 time64_t nat_keepalive_expiration; 254 255 /* Data for care-of address */ 256 xfrm_address_t *coaddr; 257 258 /* IPComp needs an IPIP tunnel for handling uncompressed packets */ 259 struct xfrm_state *tunnel; 260 261 /* If a tunnel, number of users + 1 */ 262 atomic_t tunnel_users; 263 264 /* State for replay detection */ 265 struct xfrm_replay_state replay; 266 struct xfrm_replay_state_esn *replay_esn; 267 268 /* Replay detection state at the time we sent the last notification */ 269 struct xfrm_replay_state preplay; 270 struct xfrm_replay_state_esn *preplay_esn; 271 272 /* replay detection mode */ 273 enum xfrm_replay_mode repl_mode; 274 /* internal flag that only holds state for delayed aevent at the 275 * moment 276 */ 277 u32 xflags; 278 279 /* Replay detection notification settings */ 280 u32 replay_maxage; 281 u32 replay_maxdiff; 282 283 /* Replay detection notification timer */ 284 struct timer_list rtimer; 285 286 /* Statistics */ 287 struct xfrm_stats stats; 288 289 struct xfrm_lifetime_cur curlft; 290 struct hrtimer mtimer; 291 292 struct xfrm_dev_offload xso; 293 294 /* used to fix curlft->add_time when changing date */ 295 long saved_tmo; 296 297 /* Last used time */ 298 time64_t lastused; 299 300 struct page_frag xfrag; 301 302 /* Reference to data common to all the instances of this 303 * transformer. */ 304 const struct xfrm_type *type; 305 struct xfrm_mode inner_mode; 306 struct xfrm_mode inner_mode_iaf; 307 struct xfrm_mode outer_mode; 308 309 const struct xfrm_type_offload *type_offload; 310 311 /* Security context */ 312 struct xfrm_sec_ctx *security; 313 314 /* Private data of this transformer, format is opaque, 315 * interpreted by xfrm_type methods. */ 316 void *data; 317 u8 dir; 318 319 const struct xfrm_mode_cbs *mode_cbs; 320 void *mode_data; 321}; 322 323static inline struct net *xs_net(struct xfrm_state *x) 324{ 325 return read_pnet(&x->xs_net); 326} 327 328/* xflags - make enum if more show up */ 329#define XFRM_TIME_DEFER 1 330#define XFRM_SOFT_EXPIRE 2 331 332enum { 333 XFRM_STATE_VOID, 334 XFRM_STATE_ACQ, 335 XFRM_STATE_VALID, 336 XFRM_STATE_ERROR, 337 XFRM_STATE_EXPIRED, 338 XFRM_STATE_DEAD 339}; 340 341/* callback structure passed from either netlink or pfkey */ 342struct km_event { 343 union { 344 u32 hard; 345 u32 proto; 346 u32 byid; 347 u32 aevent; 348 u32 type; 349 } data; 350 351 u32 seq; 352 u32 portid; 353 u32 event; 354 struct net *net; 355}; 356 357struct xfrm_if_decode_session_result { 358 struct net *net; 359 u32 if_id; 360}; 361 362struct xfrm_if_cb { 363 bool (*decode_session)(struct sk_buff *skb, 364 unsigned short family, 365 struct xfrm_if_decode_session_result *res); 366}; 367 368void xfrm_if_register_cb(const struct xfrm_if_cb *ifcb); 369void xfrm_if_unregister_cb(void); 370 371struct xfrm_dst_lookup_params { 372 struct net *net; 373 dscp_t dscp; 374 int oif; 375 xfrm_address_t *saddr; 376 xfrm_address_t *daddr; 377 u32 mark; 378 __u8 ipproto; 379 union flowi_uli uli; 380}; 381 382struct net_device; 383struct xfrm_type; 384struct xfrm_dst; 385struct xfrm_policy_afinfo { 386 struct dst_ops *dst_ops; 387 struct dst_entry *(*dst_lookup)(const struct xfrm_dst_lookup_params *params); 388 int (*get_saddr)(xfrm_address_t *saddr, 389 const struct xfrm_dst_lookup_params *params); 390 int (*fill_dst)(struct xfrm_dst *xdst, 391 struct net_device *dev, 392 const struct flowi *fl); 393 struct dst_entry *(*blackhole_route)(struct net *net, struct dst_entry *orig); 394}; 395 396int xfrm_policy_register_afinfo(const struct xfrm_policy_afinfo *afinfo, int family); 397void xfrm_policy_unregister_afinfo(const struct xfrm_policy_afinfo *afinfo); 398void km_policy_notify(struct xfrm_policy *xp, int dir, 399 const struct km_event *c); 400void km_state_notify(struct xfrm_state *x, const struct km_event *c); 401 402struct xfrm_tmpl; 403int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, 404 struct xfrm_policy *pol); 405void km_state_expired(struct xfrm_state *x, int hard, u32 portid); 406int __xfrm_state_delete(struct xfrm_state *x); 407 408struct xfrm_state_afinfo { 409 u8 family; 410 u8 proto; 411 412 const struct xfrm_type_offload *type_offload_esp; 413 414 const struct xfrm_type *type_esp; 415 const struct xfrm_type *type_ipip; 416 const struct xfrm_type *type_ipip6; 417 const struct xfrm_type *type_comp; 418 const struct xfrm_type *type_ah; 419 const struct xfrm_type *type_routing; 420 const struct xfrm_type *type_dstopts; 421 422 int (*output)(struct net *net, struct sock *sk, struct sk_buff *skb); 423 int (*transport_finish)(struct sk_buff *skb, 424 int async); 425 void (*local_error)(struct sk_buff *skb, u32 mtu); 426}; 427 428int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo); 429int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo); 430struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family); 431struct xfrm_state_afinfo *xfrm_state_afinfo_get_rcu(unsigned int family); 432 433struct xfrm_input_afinfo { 434 u8 family; 435 bool is_ipip; 436 int (*callback)(struct sk_buff *skb, u8 protocol, 437 int err); 438}; 439 440int xfrm_input_register_afinfo(const struct xfrm_input_afinfo *afinfo); 441int xfrm_input_unregister_afinfo(const struct xfrm_input_afinfo *afinfo); 442 443void xfrm_flush_gc(void); 444 445struct xfrm_type { 446 struct module *owner; 447 u8 proto; 448 u8 flags; 449#define XFRM_TYPE_NON_FRAGMENT 1 450#define XFRM_TYPE_REPLAY_PROT 2 451#define XFRM_TYPE_LOCAL_COADDR 4 452#define XFRM_TYPE_REMOTE_COADDR 8 453 454 int (*init_state)(struct xfrm_state *x, 455 struct netlink_ext_ack *extack); 456 void (*destructor)(struct xfrm_state *); 457 int (*input)(struct xfrm_state *, struct sk_buff *skb); 458 int (*output)(struct xfrm_state *, struct sk_buff *pskb); 459 int (*reject)(struct xfrm_state *, struct sk_buff *, 460 const struct flowi *); 461}; 462 463int xfrm_register_type(const struct xfrm_type *type, unsigned short family); 464void xfrm_unregister_type(const struct xfrm_type *type, unsigned short family); 465 466struct xfrm_type_offload { 467 struct module *owner; 468 u8 proto; 469 void (*encap)(struct xfrm_state *, struct sk_buff *pskb); 470 int (*input_tail)(struct xfrm_state *x, struct sk_buff *skb); 471 int (*xmit)(struct xfrm_state *, struct sk_buff *pskb, netdev_features_t features); 472}; 473 474int xfrm_register_type_offload(const struct xfrm_type_offload *type, unsigned short family); 475void xfrm_unregister_type_offload(const struct xfrm_type_offload *type, unsigned short family); 476void xfrm_set_type_offload(struct xfrm_state *x, bool try_load); 477static inline void xfrm_unset_type_offload(struct xfrm_state *x) 478{ 479 if (!x->type_offload) 480 return; 481 482 module_put(x->type_offload->owner); 483 x->type_offload = NULL; 484} 485 486/** 487 * struct xfrm_mode_cbs - XFRM mode callbacks 488 * @owner: module owner or NULL 489 * @init_state: Add/init mode specific state in `xfrm_state *x` 490 * @clone_state: Copy mode specific values from `orig` to new state `x` 491 * @destroy_state: Cleanup mode specific state from `xfrm_state *x` 492 * @user_init: Process mode specific netlink attributes from user 493 * @copy_to_user: Add netlink attributes to `attrs` based on state in `x` 494 * @sa_len: Return space required to store mode specific netlink attributes 495 * @get_inner_mtu: Return avail payload space after removing encap overhead 496 * @input: Process received packet from SA using mode 497 * @output: Output given packet using mode 498 * @prepare_output: Add mode specific encapsulation to packet in skb. On return 499 * `transport_header` should point at ESP header, `network_header` should 500 * point at outer IP header and `mac_header` should opint at the 501 * protocol/nexthdr field of the outer IP. 502 * 503 * One should examine and understand the specific uses of these callbacks in 504 * xfrm for further detail on how and when these functions are called. RTSL. 505 */ 506struct xfrm_mode_cbs { 507 struct module *owner; 508 int (*init_state)(struct xfrm_state *x); 509 int (*clone_state)(struct xfrm_state *x, struct xfrm_state *orig); 510 void (*destroy_state)(struct xfrm_state *x); 511 int (*user_init)(struct net *net, struct xfrm_state *x, 512 struct nlattr **attrs, 513 struct netlink_ext_ack *extack); 514 int (*copy_to_user)(struct xfrm_state *x, struct sk_buff *skb); 515 unsigned int (*sa_len)(const struct xfrm_state *x); 516 u32 (*get_inner_mtu)(struct xfrm_state *x, int outer_mtu); 517 int (*input)(struct xfrm_state *x, struct sk_buff *skb); 518 int (*output)(struct net *net, struct sock *sk, struct sk_buff *skb); 519 int (*prepare_output)(struct xfrm_state *x, struct sk_buff *skb); 520}; 521 522int xfrm_register_mode_cbs(u8 mode, const struct xfrm_mode_cbs *mode_cbs); 523void xfrm_unregister_mode_cbs(u8 mode); 524 525static inline int xfrm_af2proto(unsigned int family) 526{ 527 switch(family) { 528 case AF_INET: 529 return IPPROTO_IPIP; 530 case AF_INET6: 531 return IPPROTO_IPV6; 532 default: 533 return 0; 534 } 535} 536 537static inline const struct xfrm_mode *xfrm_ip2inner_mode(struct xfrm_state *x, int ipproto) 538{ 539 if ((x->sel.family != AF_UNSPEC) || 540 (ipproto == IPPROTO_IPIP && x->props.family == AF_INET) || 541 (ipproto == IPPROTO_IPV6 && x->props.family == AF_INET6)) 542 return &x->inner_mode; 543 else 544 return &x->inner_mode_iaf; 545} 546 547struct xfrm_tmpl { 548/* id in template is interpreted as: 549 * daddr - destination of tunnel, may be zero for transport mode. 550 * spi - zero to acquire spi. Not zero if spi is static, then 551 * daddr must be fixed too. 552 * proto - AH/ESP/IPCOMP 553 */ 554 struct xfrm_id id; 555 556/* Source address of tunnel. Ignored, if it is not a tunnel. */ 557 xfrm_address_t saddr; 558 559 unsigned short encap_family; 560 561 u32 reqid; 562 563/* Mode: transport, tunnel etc. */ 564 u8 mode; 565 566/* Sharing mode: unique, this session only, this user only etc. */ 567 u8 share; 568 569/* May skip this transfomration if no SA is found */ 570 u8 optional; 571 572/* Skip aalgos/ealgos/calgos checks. */ 573 u8 allalgs; 574 575/* Bit mask of algos allowed for acquisition */ 576 u32 aalgos; 577 u32 ealgos; 578 u32 calgos; 579}; 580 581#define XFRM_MAX_DEPTH 6 582#define XFRM_MAX_OFFLOAD_DEPTH 1 583 584struct xfrm_policy_walk_entry { 585 struct list_head all; 586 u8 dead; 587}; 588 589struct xfrm_policy_walk { 590 struct xfrm_policy_walk_entry walk; 591 u8 type; 592 u32 seq; 593}; 594 595struct xfrm_policy_queue { 596 struct sk_buff_head hold_queue; 597 struct timer_list hold_timer; 598 unsigned long timeout; 599}; 600 601/** 602 * struct xfrm_policy - xfrm policy 603 * @xp_net: network namespace the policy lives in 604 * @bydst: hlist node for SPD hash table or rbtree list 605 * @byidx: hlist node for index hash table 606 * @state_cache_list: hlist head for policy cached xfrm states 607 * @lock: serialize changes to policy structure members 608 * @refcnt: reference count, freed once it reaches 0 609 * @pos: kernel internal tie-breaker to determine age of policy 610 * @timer: timer 611 * @genid: generation, used to invalidate old policies 612 * @priority: priority, set by userspace 613 * @index: policy index (autogenerated) 614 * @if_id: virtual xfrm interface id 615 * @mark: packet mark 616 * @selector: selector 617 * @lft: liftime configuration data 618 * @curlft: liftime state 619 * @walk: list head on pernet policy list 620 * @polq: queue to hold packets while aqcuire operaion in progress 621 * @bydst_reinsert: policy tree node needs to be merged 622 * @type: XFRM_POLICY_TYPE_MAIN or _SUB 623 * @action: XFRM_POLICY_ALLOW or _BLOCK 624 * @flags: XFRM_POLICY_LOCALOK, XFRM_POLICY_ICMP 625 * @xfrm_nr: number of used templates in @xfrm_vec 626 * @family: protocol family 627 * @security: SELinux security label 628 * @xfrm_vec: array of templates to resolve state 629 * @rcu: rcu head, used to defer memory release 630 * @xdo: hardware offload state 631 */ 632struct xfrm_policy { 633 possible_net_t xp_net; 634 struct hlist_node bydst; 635 struct hlist_node byidx; 636 637 struct hlist_head state_cache_list; 638 639 /* This lock only affects elements except for entry. */ 640 rwlock_t lock; 641 refcount_t refcnt; 642 u32 pos; 643 struct timer_list timer; 644 645 atomic_t genid; 646 u32 priority; 647 u32 index; 648 u32 if_id; 649 struct xfrm_mark mark; 650 struct xfrm_selector selector; 651 struct xfrm_lifetime_cfg lft; 652 struct xfrm_lifetime_cur curlft; 653 struct xfrm_policy_walk_entry walk; 654 struct xfrm_policy_queue polq; 655 bool bydst_reinsert; 656 u8 type; 657 u8 action; 658 u8 flags; 659 u8 xfrm_nr; 660 u16 family; 661 struct xfrm_sec_ctx *security; 662 struct xfrm_tmpl xfrm_vec[XFRM_MAX_DEPTH]; 663 struct rcu_head rcu; 664 665 struct xfrm_dev_offload xdo; 666}; 667 668static inline struct net *xp_net(const struct xfrm_policy *xp) 669{ 670 return read_pnet(&xp->xp_net); 671} 672 673struct xfrm_kmaddress { 674 xfrm_address_t local; 675 xfrm_address_t remote; 676 u32 reserved; 677 u16 family; 678}; 679 680struct xfrm_migrate { 681 xfrm_address_t old_daddr; 682 xfrm_address_t old_saddr; 683 xfrm_address_t new_daddr; 684 xfrm_address_t new_saddr; 685 u8 proto; 686 u8 mode; 687 u16 reserved; 688 u32 reqid; 689 u16 old_family; 690 u16 new_family; 691}; 692 693#define XFRM_KM_TIMEOUT 30 694/* what happened */ 695#define XFRM_REPLAY_UPDATE XFRM_AE_CR 696#define XFRM_REPLAY_TIMEOUT XFRM_AE_CE 697 698/* default aevent timeout in units of 100ms */ 699#define XFRM_AE_ETIME 10 700/* Async Event timer multiplier */ 701#define XFRM_AE_ETH_M 10 702/* default seq threshold size */ 703#define XFRM_AE_SEQT_SIZE 2 704 705struct xfrm_mgr { 706 struct list_head list; 707 int (*notify)(struct xfrm_state *x, const struct km_event *c); 708 int (*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp); 709 struct xfrm_policy *(*compile_policy)(struct sock *sk, int opt, u8 *data, int len, int *dir); 710 int (*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport); 711 int (*notify_policy)(struct xfrm_policy *x, int dir, const struct km_event *c); 712 int (*report)(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr); 713 int (*migrate)(const struct xfrm_selector *sel, 714 u8 dir, u8 type, 715 const struct xfrm_migrate *m, 716 int num_bundles, 717 const struct xfrm_kmaddress *k, 718 const struct xfrm_encap_tmpl *encap); 719 bool (*is_alive)(const struct km_event *c); 720}; 721 722void xfrm_register_km(struct xfrm_mgr *km); 723void xfrm_unregister_km(struct xfrm_mgr *km); 724 725struct xfrm_tunnel_skb_cb { 726 union { 727 struct inet_skb_parm h4; 728 struct inet6_skb_parm h6; 729 } header; 730 731 union { 732 struct ip_tunnel *ip4; 733 struct ip6_tnl *ip6; 734 } tunnel; 735}; 736 737#define XFRM_TUNNEL_SKB_CB(__skb) ((struct xfrm_tunnel_skb_cb *)&((__skb)->cb[0])) 738 739/* 740 * This structure is used for the duration where packets are being 741 * transformed by IPsec. As soon as the packet leaves IPsec the 742 * area beyond the generic IP part may be overwritten. 743 */ 744struct xfrm_skb_cb { 745 struct xfrm_tunnel_skb_cb header; 746 747 /* Sequence number for replay protection. */ 748 union { 749 struct { 750 __u32 low; 751 __u32 hi; 752 } output; 753 struct { 754 __be32 low; 755 __be32 hi; 756 } input; 757 } seq; 758}; 759 760#define XFRM_SKB_CB(__skb) ((struct xfrm_skb_cb *)&((__skb)->cb[0])) 761 762/* 763 * This structure is used by the afinfo prepare_input/prepare_output functions 764 * to transmit header information to the mode input/output functions. 765 */ 766struct xfrm_mode_skb_cb { 767 struct xfrm_tunnel_skb_cb header; 768 769 /* Copied from header for IPv4, always set to zero and DF for IPv6. */ 770 __be16 id; 771 __be16 frag_off; 772 773 /* IP header length (excluding options or extension headers). */ 774 u8 ihl; 775 776 /* TOS for IPv4, class for IPv6. */ 777 u8 tos; 778 779 /* TTL for IPv4, hop limitfor IPv6. */ 780 u8 ttl; 781 782 /* Protocol for IPv4, NH for IPv6. */ 783 u8 protocol; 784 785 /* Option length for IPv4, zero for IPv6. */ 786 u8 optlen; 787 788 /* Used by IPv6 only, zero for IPv4. */ 789 u8 flow_lbl[3]; 790}; 791 792#define XFRM_MODE_SKB_CB(__skb) ((struct xfrm_mode_skb_cb *)&((__skb)->cb[0])) 793 794/* 795 * This structure is used by the input processing to locate the SPI and 796 * related information. 797 */ 798struct xfrm_spi_skb_cb { 799 struct xfrm_tunnel_skb_cb header; 800 801 unsigned int daddroff; 802 unsigned int family; 803 __be32 seq; 804}; 805 806#define XFRM_SPI_SKB_CB(__skb) ((struct xfrm_spi_skb_cb *)&((__skb)->cb[0])) 807 808#ifdef CONFIG_AUDITSYSCALL 809static inline struct audit_buffer *xfrm_audit_start(const char *op) 810{ 811 struct audit_buffer *audit_buf = NULL; 812 813 if (audit_enabled == AUDIT_OFF) 814 return NULL; 815 audit_buf = audit_log_start(audit_context(), GFP_ATOMIC, 816 AUDIT_MAC_IPSEC_EVENT); 817 if (audit_buf == NULL) 818 return NULL; 819 audit_log_format(audit_buf, "op=%s", op); 820 return audit_buf; 821} 822 823static inline void xfrm_audit_helper_usrinfo(bool task_valid, 824 struct audit_buffer *audit_buf) 825{ 826 const unsigned int auid = from_kuid(&init_user_ns, task_valid ? 827 audit_get_loginuid(current) : 828 INVALID_UID); 829 const unsigned int ses = task_valid ? audit_get_sessionid(current) : 830 AUDIT_SID_UNSET; 831 832 audit_log_format(audit_buf, " auid=%u ses=%u", auid, ses); 833 audit_log_task_context(audit_buf); 834} 835 836void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, bool task_valid); 837void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result, 838 bool task_valid); 839void xfrm_audit_state_add(struct xfrm_state *x, int result, bool task_valid); 840void xfrm_audit_state_delete(struct xfrm_state *x, int result, bool task_valid); 841void xfrm_audit_state_replay_overflow(struct xfrm_state *x, 842 struct sk_buff *skb); 843void xfrm_audit_state_replay(struct xfrm_state *x, struct sk_buff *skb, 844 __be32 net_seq); 845void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family); 846void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, __be32 net_spi, 847 __be32 net_seq); 848void xfrm_audit_state_icvfail(struct xfrm_state *x, struct sk_buff *skb, 849 u8 proto); 850#else 851 852static inline void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, 853 bool task_valid) 854{ 855} 856 857static inline void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result, 858 bool task_valid) 859{ 860} 861 862static inline void xfrm_audit_state_add(struct xfrm_state *x, int result, 863 bool task_valid) 864{ 865} 866 867static inline void xfrm_audit_state_delete(struct xfrm_state *x, int result, 868 bool task_valid) 869{ 870} 871 872static inline void xfrm_audit_state_replay_overflow(struct xfrm_state *x, 873 struct sk_buff *skb) 874{ 875} 876 877static inline void xfrm_audit_state_replay(struct xfrm_state *x, 878 struct sk_buff *skb, __be32 net_seq) 879{ 880} 881 882static inline void xfrm_audit_state_notfound_simple(struct sk_buff *skb, 883 u16 family) 884{ 885} 886 887static inline void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, 888 __be32 net_spi, __be32 net_seq) 889{ 890} 891 892static inline void xfrm_audit_state_icvfail(struct xfrm_state *x, 893 struct sk_buff *skb, u8 proto) 894{ 895} 896#endif /* CONFIG_AUDITSYSCALL */ 897 898static inline void xfrm_pol_hold(struct xfrm_policy *policy) 899{ 900 if (likely(policy != NULL)) 901 refcount_inc(&policy->refcnt); 902} 903 904void xfrm_policy_destroy(struct xfrm_policy *policy); 905 906static inline void xfrm_pol_put(struct xfrm_policy *policy) 907{ 908 if (refcount_dec_and_test(&policy->refcnt)) 909 xfrm_policy_destroy(policy); 910} 911 912static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols) 913{ 914 int i; 915 for (i = npols - 1; i >= 0; --i) 916 xfrm_pol_put(pols[i]); 917} 918 919void __xfrm_state_destroy(struct xfrm_state *); 920 921static inline void __xfrm_state_put(struct xfrm_state *x) 922{ 923 refcount_dec(&x->refcnt); 924} 925 926static inline void xfrm_state_put(struct xfrm_state *x) 927{ 928 if (refcount_dec_and_test(&x->refcnt)) 929 __xfrm_state_destroy(x); 930} 931 932static inline void xfrm_state_hold(struct xfrm_state *x) 933{ 934 refcount_inc(&x->refcnt); 935} 936 937static inline bool addr_match(const void *token1, const void *token2, 938 unsigned int prefixlen) 939{ 940 const __be32 *a1 = token1; 941 const __be32 *a2 = token2; 942 unsigned int pdw; 943 unsigned int pbi; 944 945 pdw = prefixlen >> 5; /* num of whole u32 in prefix */ 946 pbi = prefixlen & 0x1f; /* num of bits in incomplete u32 in prefix */ 947 948 if (pdw) 949 if (memcmp(a1, a2, pdw << 2)) 950 return false; 951 952 if (pbi) { 953 __be32 mask; 954 955 mask = htonl((0xffffffff) << (32 - pbi)); 956 957 if ((a1[pdw] ^ a2[pdw]) & mask) 958 return false; 959 } 960 961 return true; 962} 963 964static inline bool addr4_match(__be32 a1, __be32 a2, u8 prefixlen) 965{ 966 /* C99 6.5.7 (3): u32 << 32 is undefined behaviour */ 967 if (sizeof(long) == 4 && prefixlen == 0) 968 return true; 969 return !((a1 ^ a2) & htonl(~0UL << (32 - prefixlen))); 970} 971 972static __inline__ 973__be16 xfrm_flowi_sport(const struct flowi *fl, const union flowi_uli *uli) 974{ 975 __be16 port; 976 switch(fl->flowi_proto) { 977 case IPPROTO_TCP: 978 case IPPROTO_UDP: 979 case IPPROTO_UDPLITE: 980 case IPPROTO_SCTP: 981 port = uli->ports.sport; 982 break; 983 case IPPROTO_ICMP: 984 case IPPROTO_ICMPV6: 985 port = htons(uli->icmpt.type); 986 break; 987 case IPPROTO_MH: 988 port = htons(uli->mht.type); 989 break; 990 case IPPROTO_GRE: 991 port = htons(ntohl(uli->gre_key) >> 16); 992 break; 993 default: 994 port = 0; /*XXX*/ 995 } 996 return port; 997} 998 999static __inline__ 1000__be16 xfrm_flowi_dport(const struct flowi *fl, const union flowi_uli *uli) 1001{ 1002 __be16 port; 1003 switch(fl->flowi_proto) { 1004 case IPPROTO_TCP: 1005 case IPPROTO_UDP: 1006 case IPPROTO_UDPLITE: 1007 case IPPROTO_SCTP: 1008 port = uli->ports.dport; 1009 break; 1010 case IPPROTO_ICMP: 1011 case IPPROTO_ICMPV6: 1012 port = htons(uli->icmpt.code); 1013 break; 1014 case IPPROTO_GRE: 1015 port = htons(ntohl(uli->gre_key) & 0xffff); 1016 break; 1017 default: 1018 port = 0; /*XXX*/ 1019 } 1020 return port; 1021} 1022 1023bool xfrm_selector_match(const struct xfrm_selector *sel, 1024 const struct flowi *fl, unsigned short family); 1025 1026#ifdef CONFIG_SECURITY_NETWORK_XFRM 1027/* If neither has a context --> match 1028 * Otherwise, both must have a context and the sids, doi, alg must match 1029 */ 1030static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2) 1031{ 1032 return ((!s1 && !s2) || 1033 (s1 && s2 && 1034 (s1->ctx_sid == s2->ctx_sid) && 1035 (s1->ctx_doi == s2->ctx_doi) && 1036 (s1->ctx_alg == s2->ctx_alg))); 1037} 1038#else 1039static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2) 1040{ 1041 return true; 1042} 1043#endif 1044 1045/* A struct encoding bundle of transformations to apply to some set of flow. 1046 * 1047 * xdst->child points to the next element of bundle. 1048 * dst->xfrm points to an instanse of transformer. 1049 * 1050 * Due to unfortunate limitations of current routing cache, which we 1051 * have no time to fix, it mirrors struct rtable and bound to the same 1052 * routing key, including saddr,daddr. However, we can have many of 1053 * bundles differing by session id. All the bundles grow from a parent 1054 * policy rule. 1055 */ 1056struct xfrm_dst { 1057 union { 1058 struct dst_entry dst; 1059 struct rtable rt; 1060 struct rt6_info rt6; 1061 } u; 1062 struct dst_entry *route; 1063 struct dst_entry *child; 1064 struct dst_entry *path; 1065 struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX]; 1066 int num_pols, num_xfrms; 1067 u32 xfrm_genid; 1068 u32 policy_genid; 1069 u32 route_mtu_cached; 1070 u32 child_mtu_cached; 1071 u32 route_cookie; 1072 u32 path_cookie; 1073}; 1074 1075static inline struct dst_entry *xfrm_dst_path(const struct dst_entry *dst) 1076{ 1077#ifdef CONFIG_XFRM 1078 if (dst->xfrm || (dst->flags & DST_XFRM_QUEUE)) { 1079 const struct xfrm_dst *xdst = (const struct xfrm_dst *) dst; 1080 1081 return xdst->path; 1082 } 1083#endif 1084 return (struct dst_entry *) dst; 1085} 1086 1087static inline struct dst_entry *xfrm_dst_child(const struct dst_entry *dst) 1088{ 1089#ifdef CONFIG_XFRM 1090 if (dst->xfrm || (dst->flags & DST_XFRM_QUEUE)) { 1091 struct xfrm_dst *xdst = (struct xfrm_dst *) dst; 1092 return xdst->child; 1093 } 1094#endif 1095 return NULL; 1096} 1097 1098#ifdef CONFIG_XFRM 1099static inline void xfrm_dst_set_child(struct xfrm_dst *xdst, struct dst_entry *child) 1100{ 1101 xdst->child = child; 1102} 1103 1104static inline void xfrm_dst_destroy(struct xfrm_dst *xdst) 1105{ 1106 xfrm_pols_put(xdst->pols, xdst->num_pols); 1107 dst_release(xdst->route); 1108 if (likely(xdst->u.dst.xfrm)) 1109 xfrm_state_put(xdst->u.dst.xfrm); 1110} 1111#endif 1112 1113void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev); 1114 1115struct xfrm_if_parms { 1116 int link; /* ifindex of underlying L2 interface */ 1117 u32 if_id; /* interface identifier */ 1118 bool collect_md; 1119}; 1120 1121struct xfrm_if { 1122 struct xfrm_if __rcu *next; /* next interface in list */ 1123 struct net_device *dev; /* virtual device associated with interface */ 1124 struct net *net; /* netns for packet i/o */ 1125 struct xfrm_if_parms p; /* interface parms */ 1126 1127 struct gro_cells gro_cells; 1128}; 1129 1130struct xfrm_offload { 1131 /* Output sequence number for replay protection on offloading. */ 1132 struct { 1133 __u32 low; 1134 __u32 hi; 1135 } seq; 1136 1137 __u32 flags; 1138#define SA_DELETE_REQ 1 1139#define CRYPTO_DONE 2 1140#define CRYPTO_NEXT_DONE 4 1141#define CRYPTO_FALLBACK 8 1142#define XFRM_GSO_SEGMENT 16 1143#define XFRM_GRO 32 1144/* 64 is free */ 1145#define XFRM_DEV_RESUME 128 1146#define XFRM_XMIT 256 1147 1148 __u32 status; 1149#define CRYPTO_SUCCESS 1 1150#define CRYPTO_GENERIC_ERROR 2 1151#define CRYPTO_TRANSPORT_AH_AUTH_FAILED 4 1152#define CRYPTO_TRANSPORT_ESP_AUTH_FAILED 8 1153#define CRYPTO_TUNNEL_AH_AUTH_FAILED 16 1154#define CRYPTO_TUNNEL_ESP_AUTH_FAILED 32 1155#define CRYPTO_INVALID_PACKET_SYNTAX 64 1156#define CRYPTO_INVALID_PROTOCOL 128 1157 1158 /* Used to keep whole l2 header for transport mode GRO */ 1159 __u32 orig_mac_len; 1160 1161 __u8 proto; 1162 __u8 inner_ipproto; 1163}; 1164 1165struct sec_path { 1166 int len; 1167 int olen; 1168 int verified_cnt; 1169 1170 struct xfrm_state *xvec[XFRM_MAX_DEPTH]; 1171 struct xfrm_offload ovec[XFRM_MAX_OFFLOAD_DEPTH]; 1172}; 1173 1174struct sec_path *secpath_set(struct sk_buff *skb); 1175 1176static inline void 1177secpath_reset(struct sk_buff *skb) 1178{ 1179#ifdef CONFIG_XFRM 1180 skb_ext_del(skb, SKB_EXT_SEC_PATH); 1181#endif 1182} 1183 1184static inline int 1185xfrm_addr_any(const xfrm_address_t *addr, unsigned short family) 1186{ 1187 switch (family) { 1188 case AF_INET: 1189 return addr->a4 == 0; 1190 case AF_INET6: 1191 return ipv6_addr_any(&addr->in6); 1192 } 1193 return 0; 1194} 1195 1196static inline int 1197__xfrm4_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x) 1198{ 1199 return (tmpl->saddr.a4 && 1200 tmpl->saddr.a4 != x->props.saddr.a4); 1201} 1202 1203static inline int 1204__xfrm6_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x) 1205{ 1206 return (!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) && 1207 !ipv6_addr_equal((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr)); 1208} 1209 1210static inline int 1211xfrm_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x, unsigned short family) 1212{ 1213 switch (family) { 1214 case AF_INET: 1215 return __xfrm4_state_addr_cmp(tmpl, x); 1216 case AF_INET6: 1217 return __xfrm6_state_addr_cmp(tmpl, x); 1218 } 1219 return !0; 1220} 1221 1222#ifdef CONFIG_XFRM 1223static inline struct xfrm_state *xfrm_input_state(struct sk_buff *skb) 1224{ 1225 struct sec_path *sp = skb_sec_path(skb); 1226 1227 return sp->xvec[sp->len - 1]; 1228} 1229#endif 1230 1231static inline struct xfrm_offload *xfrm_offload(struct sk_buff *skb) 1232{ 1233#ifdef CONFIG_XFRM 1234 struct sec_path *sp = skb_sec_path(skb); 1235 1236 if (!sp || !sp->olen || sp->len != sp->olen) 1237 return NULL; 1238 1239 return &sp->ovec[sp->olen - 1]; 1240#else 1241 return NULL; 1242#endif 1243} 1244 1245#ifdef CONFIG_XFRM 1246int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb, 1247 unsigned short family); 1248 1249static inline bool __xfrm_check_nopolicy(struct net *net, struct sk_buff *skb, 1250 int dir) 1251{ 1252 if (!net->xfrm.policy_count[dir] && !secpath_exists(skb)) 1253 return net->xfrm.policy_default[dir] == XFRM_USERPOLICY_ACCEPT; 1254 1255 return false; 1256} 1257 1258static inline bool __xfrm_check_dev_nopolicy(struct sk_buff *skb, 1259 int dir, unsigned short family) 1260{ 1261 if (dir != XFRM_POLICY_OUT && family == AF_INET) { 1262 /* same dst may be used for traffic originating from 1263 * devices with different policy settings. 1264 */ 1265 return IPCB(skb)->flags & IPSKB_NOPOLICY; 1266 } 1267 return skb_dst(skb) && (skb_dst(skb)->flags & DST_NOPOLICY); 1268} 1269 1270static inline int __xfrm_policy_check2(struct sock *sk, int dir, 1271 struct sk_buff *skb, 1272 unsigned int family, int reverse) 1273{ 1274 struct net *net = dev_net(skb->dev); 1275 int ndir = dir | (reverse ? XFRM_POLICY_MASK + 1 : 0); 1276 struct xfrm_offload *xo = xfrm_offload(skb); 1277 struct xfrm_state *x; 1278 1279 if (sk && sk->sk_policy[XFRM_POLICY_IN]) 1280 return __xfrm_policy_check(sk, ndir, skb, family); 1281 1282 if (xo) { 1283 x = xfrm_input_state(skb); 1284 if (x->xso.type == XFRM_DEV_OFFLOAD_PACKET) { 1285 bool check = (xo->flags & CRYPTO_DONE) && 1286 (xo->status & CRYPTO_SUCCESS); 1287 1288 /* The packets here are plain ones and secpath was 1289 * needed to indicate that hardware already handled 1290 * them and there is no need to do nothing in addition. 1291 * 1292 * Consume secpath which was set by drivers. 1293 */ 1294 secpath_reset(skb); 1295 return check; 1296 } 1297 } 1298 1299 return __xfrm_check_nopolicy(net, skb, dir) || 1300 __xfrm_check_dev_nopolicy(skb, dir, family) || 1301 __xfrm_policy_check(sk, ndir, skb, family); 1302} 1303 1304static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family) 1305{ 1306 return __xfrm_policy_check2(sk, dir, skb, family, 0); 1307} 1308 1309static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 1310{ 1311 return xfrm_policy_check(sk, dir, skb, AF_INET); 1312} 1313 1314static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 1315{ 1316 return xfrm_policy_check(sk, dir, skb, AF_INET6); 1317} 1318 1319static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir, 1320 struct sk_buff *skb) 1321{ 1322 return __xfrm_policy_check2(sk, dir, skb, AF_INET, 1); 1323} 1324 1325static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir, 1326 struct sk_buff *skb) 1327{ 1328 return __xfrm_policy_check2(sk, dir, skb, AF_INET6, 1); 1329} 1330 1331int __xfrm_decode_session(struct net *net, struct sk_buff *skb, struct flowi *fl, 1332 unsigned int family, int reverse); 1333 1334static inline int xfrm_decode_session(struct net *net, struct sk_buff *skb, struct flowi *fl, 1335 unsigned int family) 1336{ 1337 return __xfrm_decode_session(net, skb, fl, family, 0); 1338} 1339 1340static inline int xfrm_decode_session_reverse(struct net *net, struct sk_buff *skb, 1341 struct flowi *fl, 1342 unsigned int family) 1343{ 1344 return __xfrm_decode_session(net, skb, fl, family, 1); 1345} 1346 1347int __xfrm_route_forward(struct sk_buff *skb, unsigned short family); 1348 1349static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family) 1350{ 1351 struct net *net = dev_net(skb->dev); 1352 1353 if (!net->xfrm.policy_count[XFRM_POLICY_OUT] && 1354 net->xfrm.policy_default[XFRM_POLICY_OUT] == XFRM_USERPOLICY_ACCEPT) 1355 return true; 1356 1357 return (skb_dst(skb)->flags & DST_NOXFRM) || 1358 __xfrm_route_forward(skb, family); 1359} 1360 1361static inline int xfrm4_route_forward(struct sk_buff *skb) 1362{ 1363 return xfrm_route_forward(skb, AF_INET); 1364} 1365 1366static inline int xfrm6_route_forward(struct sk_buff *skb) 1367{ 1368 return xfrm_route_forward(skb, AF_INET6); 1369} 1370 1371int __xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk); 1372 1373static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk) 1374{ 1375 if (!sk_fullsock(osk)) 1376 return 0; 1377 sk->sk_policy[0] = NULL; 1378 sk->sk_policy[1] = NULL; 1379 if (unlikely(osk->sk_policy[0] || osk->sk_policy[1])) 1380 return __xfrm_sk_clone_policy(sk, osk); 1381 return 0; 1382} 1383 1384int xfrm_policy_delete(struct xfrm_policy *pol, int dir); 1385 1386static inline void xfrm_sk_free_policy(struct sock *sk) 1387{ 1388 struct xfrm_policy *pol; 1389 1390 pol = rcu_dereference_protected(sk->sk_policy[0], 1); 1391 if (unlikely(pol != NULL)) { 1392 xfrm_policy_delete(pol, XFRM_POLICY_MAX); 1393 sk->sk_policy[0] = NULL; 1394 } 1395 pol = rcu_dereference_protected(sk->sk_policy[1], 1); 1396 if (unlikely(pol != NULL)) { 1397 xfrm_policy_delete(pol, XFRM_POLICY_MAX+1); 1398 sk->sk_policy[1] = NULL; 1399 } 1400} 1401 1402#else 1403 1404static inline void xfrm_sk_free_policy(struct sock *sk) {} 1405static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk) { return 0; } 1406static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; } 1407static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; } 1408static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 1409{ 1410 return 1; 1411} 1412static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 1413{ 1414 return 1; 1415} 1416static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family) 1417{ 1418 return 1; 1419} 1420static inline int xfrm_decode_session_reverse(struct net *net, struct sk_buff *skb, 1421 struct flowi *fl, 1422 unsigned int family) 1423{ 1424 return -ENOSYS; 1425} 1426static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir, 1427 struct sk_buff *skb) 1428{ 1429 return 1; 1430} 1431static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir, 1432 struct sk_buff *skb) 1433{ 1434 return 1; 1435} 1436#endif 1437 1438static __inline__ 1439xfrm_address_t *xfrm_flowi_daddr(const struct flowi *fl, unsigned short family) 1440{ 1441 switch (family){ 1442 case AF_INET: 1443 return (xfrm_address_t *)&fl->u.ip4.daddr; 1444 case AF_INET6: 1445 return (xfrm_address_t *)&fl->u.ip6.daddr; 1446 } 1447 return NULL; 1448} 1449 1450static __inline__ 1451xfrm_address_t *xfrm_flowi_saddr(const struct flowi *fl, unsigned short family) 1452{ 1453 switch (family){ 1454 case AF_INET: 1455 return (xfrm_address_t *)&fl->u.ip4.saddr; 1456 case AF_INET6: 1457 return (xfrm_address_t *)&fl->u.ip6.saddr; 1458 } 1459 return NULL; 1460} 1461 1462static __inline__ 1463void xfrm_flowi_addr_get(const struct flowi *fl, 1464 xfrm_address_t *saddr, xfrm_address_t *daddr, 1465 unsigned short family) 1466{ 1467 switch(family) { 1468 case AF_INET: 1469 memcpy(&saddr->a4, &fl->u.ip4.saddr, sizeof(saddr->a4)); 1470 memcpy(&daddr->a4, &fl->u.ip4.daddr, sizeof(daddr->a4)); 1471 break; 1472 case AF_INET6: 1473 saddr->in6 = fl->u.ip6.saddr; 1474 daddr->in6 = fl->u.ip6.daddr; 1475 break; 1476 } 1477} 1478 1479static __inline__ int 1480__xfrm4_state_addr_check(const struct xfrm_state *x, 1481 const xfrm_address_t *daddr, const xfrm_address_t *saddr) 1482{ 1483 if (daddr->a4 == x->id.daddr.a4 && 1484 (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4)) 1485 return 1; 1486 return 0; 1487} 1488 1489static __inline__ int 1490__xfrm6_state_addr_check(const struct xfrm_state *x, 1491 const xfrm_address_t *daddr, const xfrm_address_t *saddr) 1492{ 1493 if (ipv6_addr_equal((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) && 1494 (ipv6_addr_equal((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr) || 1495 ipv6_addr_any((struct in6_addr *)saddr) || 1496 ipv6_addr_any((struct in6_addr *)&x->props.saddr))) 1497 return 1; 1498 return 0; 1499} 1500 1501static __inline__ int 1502xfrm_state_addr_check(const struct xfrm_state *x, 1503 const xfrm_address_t *daddr, const xfrm_address_t *saddr, 1504 unsigned short family) 1505{ 1506 switch (family) { 1507 case AF_INET: 1508 return __xfrm4_state_addr_check(x, daddr, saddr); 1509 case AF_INET6: 1510 return __xfrm6_state_addr_check(x, daddr, saddr); 1511 } 1512 return 0; 1513} 1514 1515static __inline__ int 1516xfrm_state_addr_flow_check(const struct xfrm_state *x, const struct flowi *fl, 1517 unsigned short family) 1518{ 1519 switch (family) { 1520 case AF_INET: 1521 return __xfrm4_state_addr_check(x, 1522 (const xfrm_address_t *)&fl->u.ip4.daddr, 1523 (const xfrm_address_t *)&fl->u.ip4.saddr); 1524 case AF_INET6: 1525 return __xfrm6_state_addr_check(x, 1526 (const xfrm_address_t *)&fl->u.ip6.daddr, 1527 (const xfrm_address_t *)&fl->u.ip6.saddr); 1528 } 1529 return 0; 1530} 1531 1532static inline int xfrm_state_kern(const struct xfrm_state *x) 1533{ 1534 return atomic_read(&x->tunnel_users); 1535} 1536 1537static inline bool xfrm_id_proto_valid(u8 proto) 1538{ 1539 switch (proto) { 1540 case IPPROTO_AH: 1541 case IPPROTO_ESP: 1542 case IPPROTO_COMP: 1543#if IS_ENABLED(CONFIG_IPV6) 1544 case IPPROTO_ROUTING: 1545 case IPPROTO_DSTOPTS: 1546#endif 1547 return true; 1548 default: 1549 return false; 1550 } 1551} 1552 1553/* IPSEC_PROTO_ANY only matches 3 IPsec protocols, 0 could match all. */ 1554static inline int xfrm_id_proto_match(u8 proto, u8 userproto) 1555{ 1556 return (!userproto || proto == userproto || 1557 (userproto == IPSEC_PROTO_ANY && (proto == IPPROTO_AH || 1558 proto == IPPROTO_ESP || 1559 proto == IPPROTO_COMP))); 1560} 1561 1562/* 1563 * xfrm algorithm information 1564 */ 1565struct xfrm_algo_aead_info { 1566 char *geniv; 1567 u16 icv_truncbits; 1568}; 1569 1570struct xfrm_algo_auth_info { 1571 u16 icv_truncbits; 1572 u16 icv_fullbits; 1573}; 1574 1575struct xfrm_algo_encr_info { 1576 char *geniv; 1577 u16 blockbits; 1578 u16 defkeybits; 1579}; 1580 1581struct xfrm_algo_comp_info { 1582 u16 threshold; 1583}; 1584 1585struct xfrm_algo_desc { 1586 char *name; 1587 char *compat; 1588 u8 available:1; 1589 u8 pfkey_supported:1; 1590 union { 1591 struct xfrm_algo_aead_info aead; 1592 struct xfrm_algo_auth_info auth; 1593 struct xfrm_algo_encr_info encr; 1594 struct xfrm_algo_comp_info comp; 1595 } uinfo; 1596 struct sadb_alg desc; 1597}; 1598 1599/* XFRM protocol handlers. */ 1600struct xfrm4_protocol { 1601 int (*handler)(struct sk_buff *skb); 1602 int (*input_handler)(struct sk_buff *skb, int nexthdr, __be32 spi, 1603 int encap_type); 1604 int (*cb_handler)(struct sk_buff *skb, int err); 1605 int (*err_handler)(struct sk_buff *skb, u32 info); 1606 1607 struct xfrm4_protocol __rcu *next; 1608 int priority; 1609}; 1610 1611struct xfrm6_protocol { 1612 int (*handler)(struct sk_buff *skb); 1613 int (*input_handler)(struct sk_buff *skb, int nexthdr, __be32 spi, 1614 int encap_type); 1615 int (*cb_handler)(struct sk_buff *skb, int err); 1616 int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt, 1617 u8 type, u8 code, int offset, __be32 info); 1618 1619 struct xfrm6_protocol __rcu *next; 1620 int priority; 1621}; 1622 1623/* XFRM tunnel handlers. */ 1624struct xfrm_tunnel { 1625 int (*handler)(struct sk_buff *skb); 1626 int (*cb_handler)(struct sk_buff *skb, int err); 1627 int (*err_handler)(struct sk_buff *skb, u32 info); 1628 1629 struct xfrm_tunnel __rcu *next; 1630 int priority; 1631}; 1632 1633struct xfrm6_tunnel { 1634 int (*handler)(struct sk_buff *skb); 1635 int (*cb_handler)(struct sk_buff *skb, int err); 1636 int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt, 1637 u8 type, u8 code, int offset, __be32 info); 1638 struct xfrm6_tunnel __rcu *next; 1639 int priority; 1640}; 1641 1642void xfrm_init(void); 1643void xfrm4_init(void); 1644int xfrm_state_init(struct net *net); 1645void xfrm_state_fini(struct net *net); 1646void xfrm4_state_init(void); 1647void xfrm4_protocol_init(void); 1648#ifdef CONFIG_XFRM 1649int xfrm6_init(void); 1650void xfrm6_fini(void); 1651int xfrm6_state_init(void); 1652void xfrm6_state_fini(void); 1653int xfrm6_protocol_init(void); 1654void xfrm6_protocol_fini(void); 1655#else 1656static inline int xfrm6_init(void) 1657{ 1658 return 0; 1659} 1660static inline void xfrm6_fini(void) 1661{ 1662 ; 1663} 1664#endif 1665 1666#ifdef CONFIG_XFRM_STATISTICS 1667int xfrm_proc_init(struct net *net); 1668void xfrm_proc_fini(struct net *net); 1669#endif 1670 1671int xfrm_sysctl_init(struct net *net); 1672#ifdef CONFIG_SYSCTL 1673void xfrm_sysctl_fini(struct net *net); 1674#else 1675static inline void xfrm_sysctl_fini(struct net *net) 1676{ 1677} 1678#endif 1679 1680void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto, 1681 struct xfrm_address_filter *filter); 1682int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk, 1683 int (*func)(struct xfrm_state *, int, void*), void *); 1684void xfrm_state_walk_done(struct xfrm_state_walk *walk, struct net *net); 1685struct xfrm_state *xfrm_state_alloc(struct net *net); 1686void xfrm_state_free(struct xfrm_state *x); 1687struct xfrm_state *xfrm_state_find(const xfrm_address_t *daddr, 1688 const xfrm_address_t *saddr, 1689 const struct flowi *fl, 1690 struct xfrm_tmpl *tmpl, 1691 struct xfrm_policy *pol, int *err, 1692 unsigned short family, u32 if_id); 1693struct xfrm_state *xfrm_stateonly_find(struct net *net, u32 mark, u32 if_id, 1694 xfrm_address_t *daddr, 1695 xfrm_address_t *saddr, 1696 unsigned short family, 1697 u8 mode, u8 proto, u32 reqid); 1698struct xfrm_state *xfrm_state_lookup_byspi(struct net *net, __be32 spi, 1699 unsigned short family); 1700int xfrm_state_check_expire(struct xfrm_state *x); 1701void xfrm_state_update_stats(struct net *net); 1702#ifdef CONFIG_XFRM_OFFLOAD 1703static inline void xfrm_dev_state_update_stats(struct xfrm_state *x) 1704{ 1705 struct xfrm_dev_offload *xdo = &x->xso; 1706 struct net_device *dev = READ_ONCE(xdo->dev); 1707 1708 if (dev && dev->xfrmdev_ops && 1709 dev->xfrmdev_ops->xdo_dev_state_update_stats) 1710 dev->xfrmdev_ops->xdo_dev_state_update_stats(x); 1711 1712} 1713#else 1714static inline void xfrm_dev_state_update_stats(struct xfrm_state *x) {} 1715#endif 1716void xfrm_state_insert(struct xfrm_state *x); 1717int xfrm_state_add(struct xfrm_state *x); 1718int xfrm_state_update(struct xfrm_state *x); 1719struct xfrm_state *xfrm_state_lookup(struct net *net, u32 mark, 1720 const xfrm_address_t *daddr, __be32 spi, 1721 u8 proto, unsigned short family); 1722struct xfrm_state *xfrm_input_state_lookup(struct net *net, u32 mark, 1723 const xfrm_address_t *daddr, 1724 __be32 spi, u8 proto, 1725 unsigned short family); 1726struct xfrm_state *xfrm_state_lookup_byaddr(struct net *net, u32 mark, 1727 const xfrm_address_t *daddr, 1728 const xfrm_address_t *saddr, 1729 u8 proto, 1730 unsigned short family); 1731#ifdef CONFIG_XFRM_SUB_POLICY 1732void xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n, 1733 unsigned short family); 1734void xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n, 1735 unsigned short family); 1736#else 1737static inline void xfrm_tmpl_sort(struct xfrm_tmpl **d, struct xfrm_tmpl **s, 1738 int n, unsigned short family) 1739{ 1740} 1741 1742static inline void xfrm_state_sort(struct xfrm_state **d, struct xfrm_state **s, 1743 int n, unsigned short family) 1744{ 1745} 1746#endif 1747 1748struct xfrmk_sadinfo { 1749 u32 sadhcnt; /* current hash bkts */ 1750 u32 sadhmcnt; /* max allowed hash bkts */ 1751 u32 sadcnt; /* current running count */ 1752}; 1753 1754struct xfrmk_spdinfo { 1755 u32 incnt; 1756 u32 outcnt; 1757 u32 fwdcnt; 1758 u32 inscnt; 1759 u32 outscnt; 1760 u32 fwdscnt; 1761 u32 spdhcnt; 1762 u32 spdhmcnt; 1763}; 1764 1765struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq, u32 pcpu_num); 1766int xfrm_state_delete(struct xfrm_state *x); 1767int xfrm_state_flush(struct net *net, u8 proto, bool task_valid); 1768int xfrm_dev_state_flush(struct net *net, struct net_device *dev, bool task_valid); 1769int xfrm_dev_policy_flush(struct net *net, struct net_device *dev, 1770 bool task_valid); 1771void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si); 1772void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si); 1773u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq); 1774int xfrm_init_replay(struct xfrm_state *x, struct netlink_ext_ack *extack); 1775u32 xfrm_state_mtu(struct xfrm_state *x, int mtu); 1776int __xfrm_init_state(struct xfrm_state *x, struct netlink_ext_ack *extack); 1777int xfrm_init_state(struct xfrm_state *x); 1778int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type); 1779int xfrm_input_resume(struct sk_buff *skb, int nexthdr); 1780int xfrm_trans_queue_net(struct net *net, struct sk_buff *skb, 1781 int (*finish)(struct net *, struct sock *, 1782 struct sk_buff *)); 1783int xfrm_trans_queue(struct sk_buff *skb, 1784 int (*finish)(struct net *, struct sock *, 1785 struct sk_buff *)); 1786int xfrm_output_resume(struct sock *sk, struct sk_buff *skb, int err); 1787int xfrm_output(struct sock *sk, struct sk_buff *skb); 1788int xfrm4_tunnel_check_size(struct sk_buff *skb); 1789#if IS_ENABLED(CONFIG_IPV6) 1790int xfrm6_tunnel_check_size(struct sk_buff *skb); 1791#else 1792static inline int xfrm6_tunnel_check_size(struct sk_buff *skb) 1793{ 1794 return -EMSGSIZE; 1795} 1796#endif 1797 1798#if IS_ENABLED(CONFIG_NET_PKTGEN) 1799int pktgen_xfrm_outer_mode_output(struct xfrm_state *x, struct sk_buff *skb); 1800#endif 1801 1802void xfrm_local_error(struct sk_buff *skb, int mtu); 1803int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi, 1804 int encap_type); 1805int xfrm4_transport_finish(struct sk_buff *skb, int async); 1806int xfrm4_rcv(struct sk_buff *skb); 1807 1808static inline int xfrm4_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi) 1809{ 1810 XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL; 1811 XFRM_SPI_SKB_CB(skb)->family = AF_INET; 1812 XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr); 1813 return xfrm_input(skb, nexthdr, spi, 0); 1814} 1815 1816int xfrm4_output(struct net *net, struct sock *sk, struct sk_buff *skb); 1817int xfrm4_protocol_register(struct xfrm4_protocol *handler, unsigned char protocol); 1818int xfrm4_protocol_deregister(struct xfrm4_protocol *handler, unsigned char protocol); 1819int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family); 1820int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family); 1821void xfrm4_local_error(struct sk_buff *skb, u32 mtu); 1822int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi, 1823 struct ip6_tnl *t); 1824int xfrm6_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi, 1825 int encap_type); 1826int xfrm6_transport_finish(struct sk_buff *skb, int async); 1827int xfrm6_rcv_tnl(struct sk_buff *skb, struct ip6_tnl *t); 1828int xfrm6_rcv(struct sk_buff *skb); 1829int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr, 1830 xfrm_address_t *saddr, u8 proto); 1831void xfrm6_local_error(struct sk_buff *skb, u32 mtu); 1832int xfrm6_protocol_register(struct xfrm6_protocol *handler, unsigned char protocol); 1833int xfrm6_protocol_deregister(struct xfrm6_protocol *handler, unsigned char protocol); 1834int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family); 1835int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family); 1836__be32 xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr); 1837__be32 xfrm6_tunnel_spi_lookup(struct net *net, const xfrm_address_t *saddr); 1838int xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb); 1839 1840#ifdef CONFIG_XFRM 1841void xfrm6_local_rxpmtu(struct sk_buff *skb, u32 mtu); 1842int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb); 1843int xfrm6_udp_encap_rcv(struct sock *sk, struct sk_buff *skb); 1844struct sk_buff *xfrm4_gro_udp_encap_rcv(struct sock *sk, struct list_head *head, 1845 struct sk_buff *skb); 1846struct sk_buff *xfrm6_gro_udp_encap_rcv(struct sock *sk, struct list_head *head, 1847 struct sk_buff *skb); 1848int xfrm_user_policy(struct sock *sk, int optname, sockptr_t optval, 1849 int optlen); 1850#else 1851static inline int xfrm_user_policy(struct sock *sk, int optname, 1852 sockptr_t optval, int optlen) 1853{ 1854 return -ENOPROTOOPT; 1855} 1856#endif 1857 1858struct dst_entry *__xfrm_dst_lookup(int family, const struct xfrm_dst_lookup_params *params); 1859 1860struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp); 1861 1862void xfrm_policy_walk_init(struct xfrm_policy_walk *walk, u8 type); 1863int xfrm_policy_walk(struct net *net, struct xfrm_policy_walk *walk, 1864 int (*func)(struct xfrm_policy *, int, int, void*), 1865 void *); 1866void xfrm_policy_walk_done(struct xfrm_policy_walk *walk, struct net *net); 1867int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl); 1868struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, 1869 const struct xfrm_mark *mark, 1870 u32 if_id, u8 type, int dir, 1871 struct xfrm_selector *sel, 1872 struct xfrm_sec_ctx *ctx, int delete, 1873 int *err); 1874struct xfrm_policy *xfrm_policy_byid(struct net *net, 1875 const struct xfrm_mark *mark, u32 if_id, 1876 u8 type, int dir, u32 id, int delete, 1877 int *err); 1878int xfrm_policy_flush(struct net *net, u8 type, bool task_valid); 1879void xfrm_policy_hash_rebuild(struct net *net); 1880u32 xfrm_get_acqseq(void); 1881int verify_spi_info(u8 proto, u32 min, u32 max, struct netlink_ext_ack *extack); 1882int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi, 1883 struct netlink_ext_ack *extack); 1884struct xfrm_state *xfrm_find_acq(struct net *net, const struct xfrm_mark *mark, 1885 u8 mode, u32 reqid, u32 if_id, u32 pcpu_num, u8 proto, 1886 const xfrm_address_t *daddr, 1887 const xfrm_address_t *saddr, int create, 1888 unsigned short family); 1889int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol); 1890 1891#ifdef CONFIG_XFRM_MIGRATE 1892int km_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, 1893 const struct xfrm_migrate *m, int num_bundles, 1894 const struct xfrm_kmaddress *k, 1895 const struct xfrm_encap_tmpl *encap); 1896struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net, 1897 u32 if_id); 1898struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x, 1899 struct xfrm_migrate *m, 1900 struct xfrm_encap_tmpl *encap, 1901 struct net *net, 1902 struct xfrm_user_offload *xuo, 1903 struct netlink_ext_ack *extack); 1904int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, 1905 struct xfrm_migrate *m, int num_bundles, 1906 struct xfrm_kmaddress *k, struct net *net, 1907 struct xfrm_encap_tmpl *encap, u32 if_id, 1908 struct netlink_ext_ack *extack, 1909 struct xfrm_user_offload *xuo); 1910#endif 1911 1912int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport); 1913void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 portid); 1914int km_report(struct net *net, u8 proto, struct xfrm_selector *sel, 1915 xfrm_address_t *addr); 1916 1917void xfrm_input_init(void); 1918int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq); 1919 1920void xfrm_probe_algs(void); 1921int xfrm_count_pfkey_auth_supported(void); 1922int xfrm_count_pfkey_enc_supported(void); 1923struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx); 1924struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx); 1925struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id); 1926struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id); 1927struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id); 1928struct xfrm_algo_desc *xfrm_aalg_get_byname(const char *name, int probe); 1929struct xfrm_algo_desc *xfrm_ealg_get_byname(const char *name, int probe); 1930struct xfrm_algo_desc *xfrm_calg_get_byname(const char *name, int probe); 1931struct xfrm_algo_desc *xfrm_aead_get_byname(const char *name, int icv_len, 1932 int probe); 1933 1934static inline bool xfrm6_addr_equal(const xfrm_address_t *a, 1935 const xfrm_address_t *b) 1936{ 1937 return ipv6_addr_equal((const struct in6_addr *)a, 1938 (const struct in6_addr *)b); 1939} 1940 1941static inline bool xfrm_addr_equal(const xfrm_address_t *a, 1942 const xfrm_address_t *b, 1943 sa_family_t family) 1944{ 1945 switch (family) { 1946 default: 1947 case AF_INET: 1948 return ((__force u32)a->a4 ^ (__force u32)b->a4) == 0; 1949 case AF_INET6: 1950 return xfrm6_addr_equal(a, b); 1951 } 1952} 1953 1954static inline int xfrm_policy_id2dir(u32 index) 1955{ 1956 return index & 7; 1957} 1958 1959#ifdef CONFIG_XFRM 1960void xfrm_replay_advance(struct xfrm_state *x, __be32 net_seq); 1961int xfrm_replay_check(struct xfrm_state *x, struct sk_buff *skb, __be32 net_seq); 1962void xfrm_replay_notify(struct xfrm_state *x, int event); 1963int xfrm_replay_overflow(struct xfrm_state *x, struct sk_buff *skb); 1964int xfrm_replay_recheck(struct xfrm_state *x, struct sk_buff *skb, __be32 net_seq); 1965 1966static inline int xfrm_aevent_is_on(struct net *net) 1967{ 1968 struct sock *nlsk; 1969 int ret = 0; 1970 1971 rcu_read_lock(); 1972 nlsk = rcu_dereference(net->xfrm.nlsk); 1973 if (nlsk) 1974 ret = netlink_has_listeners(nlsk, XFRMNLGRP_AEVENTS); 1975 rcu_read_unlock(); 1976 return ret; 1977} 1978 1979static inline int xfrm_acquire_is_on(struct net *net) 1980{ 1981 struct sock *nlsk; 1982 int ret = 0; 1983 1984 rcu_read_lock(); 1985 nlsk = rcu_dereference(net->xfrm.nlsk); 1986 if (nlsk) 1987 ret = netlink_has_listeners(nlsk, XFRMNLGRP_ACQUIRE); 1988 rcu_read_unlock(); 1989 1990 return ret; 1991} 1992#endif 1993 1994static inline unsigned int aead_len(struct xfrm_algo_aead *alg) 1995{ 1996 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8); 1997} 1998 1999static inline unsigned int xfrm_alg_len(const struct xfrm_algo *alg) 2000{ 2001 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8); 2002} 2003 2004static inline unsigned int xfrm_alg_auth_len(const struct xfrm_algo_auth *alg) 2005{ 2006 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8); 2007} 2008 2009static inline unsigned int xfrm_replay_state_esn_len(struct xfrm_replay_state_esn *replay_esn) 2010{ 2011 return sizeof(*replay_esn) + replay_esn->bmp_len * sizeof(__u32); 2012} 2013 2014#ifdef CONFIG_XFRM_MIGRATE 2015static inline int xfrm_replay_clone(struct xfrm_state *x, 2016 struct xfrm_state *orig) 2017{ 2018 2019 x->replay_esn = kmemdup(orig->replay_esn, 2020 xfrm_replay_state_esn_len(orig->replay_esn), 2021 GFP_KERNEL); 2022 if (!x->replay_esn) 2023 return -ENOMEM; 2024 x->preplay_esn = kmemdup(orig->preplay_esn, 2025 xfrm_replay_state_esn_len(orig->preplay_esn), 2026 GFP_KERNEL); 2027 if (!x->preplay_esn) 2028 return -ENOMEM; 2029 2030 return 0; 2031} 2032 2033static inline struct xfrm_algo_aead *xfrm_algo_aead_clone(struct xfrm_algo_aead *orig) 2034{ 2035 return kmemdup(orig, aead_len(orig), GFP_KERNEL); 2036} 2037 2038 2039static inline struct xfrm_algo *xfrm_algo_clone(struct xfrm_algo *orig) 2040{ 2041 return kmemdup(orig, xfrm_alg_len(orig), GFP_KERNEL); 2042} 2043 2044static inline struct xfrm_algo_auth *xfrm_algo_auth_clone(struct xfrm_algo_auth *orig) 2045{ 2046 return kmemdup(orig, xfrm_alg_auth_len(orig), GFP_KERNEL); 2047} 2048 2049static inline void xfrm_states_put(struct xfrm_state **states, int n) 2050{ 2051 int i; 2052 for (i = 0; i < n; i++) 2053 xfrm_state_put(*(states + i)); 2054} 2055 2056static inline void xfrm_states_delete(struct xfrm_state **states, int n) 2057{ 2058 int i; 2059 for (i = 0; i < n; i++) 2060 xfrm_state_delete(*(states + i)); 2061} 2062#endif 2063 2064void __init xfrm_dev_init(void); 2065 2066#ifdef CONFIG_XFRM_OFFLOAD 2067void xfrm_dev_resume(struct sk_buff *skb); 2068void xfrm_dev_backlog(struct softnet_data *sd); 2069struct sk_buff *validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t features, bool *again); 2070int xfrm_dev_state_add(struct net *net, struct xfrm_state *x, 2071 struct xfrm_user_offload *xuo, 2072 struct netlink_ext_ack *extack); 2073int xfrm_dev_policy_add(struct net *net, struct xfrm_policy *xp, 2074 struct xfrm_user_offload *xuo, u8 dir, 2075 struct netlink_ext_ack *extack); 2076bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x); 2077void xfrm_dev_state_delete(struct xfrm_state *x); 2078void xfrm_dev_state_free(struct xfrm_state *x); 2079 2080static inline void xfrm_dev_state_advance_esn(struct xfrm_state *x) 2081{ 2082 struct xfrm_dev_offload *xso = &x->xso; 2083 struct net_device *dev = READ_ONCE(xso->dev); 2084 2085 if (dev && dev->xfrmdev_ops->xdo_dev_state_advance_esn) 2086 dev->xfrmdev_ops->xdo_dev_state_advance_esn(x); 2087} 2088 2089static inline bool xfrm_dst_offload_ok(struct dst_entry *dst) 2090{ 2091 struct xfrm_state *x = dst->xfrm; 2092 struct xfrm_dst *xdst; 2093 2094 if (!x || !x->type_offload) 2095 return false; 2096 2097 xdst = (struct xfrm_dst *) dst; 2098 if (!x->xso.offload_handle && !xdst->child->xfrm) 2099 return true; 2100 if (x->xso.offload_handle && (x->xso.dev == xfrm_dst_path(dst)->dev) && 2101 !xdst->child->xfrm) 2102 return true; 2103 2104 return false; 2105} 2106 2107static inline void xfrm_dev_policy_delete(struct xfrm_policy *x) 2108{ 2109 struct xfrm_dev_offload *xdo = &x->xdo; 2110 struct net_device *dev = xdo->dev; 2111 2112 if (dev && dev->xfrmdev_ops && dev->xfrmdev_ops->xdo_dev_policy_delete) 2113 dev->xfrmdev_ops->xdo_dev_policy_delete(x); 2114} 2115 2116static inline void xfrm_dev_policy_free(struct xfrm_policy *x) 2117{ 2118 struct xfrm_dev_offload *xdo = &x->xdo; 2119 struct net_device *dev = xdo->dev; 2120 2121 if (dev && dev->xfrmdev_ops) { 2122 if (dev->xfrmdev_ops->xdo_dev_policy_free) 2123 dev->xfrmdev_ops->xdo_dev_policy_free(x); 2124 xdo->dev = NULL; 2125 netdev_put(dev, &xdo->dev_tracker); 2126 } 2127} 2128#else 2129static inline void xfrm_dev_resume(struct sk_buff *skb) 2130{ 2131} 2132 2133static inline void xfrm_dev_backlog(struct softnet_data *sd) 2134{ 2135} 2136 2137static inline struct sk_buff *validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t features, bool *again) 2138{ 2139 return skb; 2140} 2141 2142static inline int xfrm_dev_state_add(struct net *net, struct xfrm_state *x, struct xfrm_user_offload *xuo, struct netlink_ext_ack *extack) 2143{ 2144 return 0; 2145} 2146 2147static inline void xfrm_dev_state_delete(struct xfrm_state *x) 2148{ 2149} 2150 2151static inline void xfrm_dev_state_free(struct xfrm_state *x) 2152{ 2153} 2154 2155static inline int xfrm_dev_policy_add(struct net *net, struct xfrm_policy *xp, 2156 struct xfrm_user_offload *xuo, u8 dir, 2157 struct netlink_ext_ack *extack) 2158{ 2159 return 0; 2160} 2161 2162static inline void xfrm_dev_policy_delete(struct xfrm_policy *x) 2163{ 2164} 2165 2166static inline void xfrm_dev_policy_free(struct xfrm_policy *x) 2167{ 2168} 2169 2170static inline bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x) 2171{ 2172 return false; 2173} 2174 2175static inline void xfrm_dev_state_advance_esn(struct xfrm_state *x) 2176{ 2177} 2178 2179static inline bool xfrm_dst_offload_ok(struct dst_entry *dst) 2180{ 2181 return false; 2182} 2183#endif 2184 2185static inline int xfrm_mark_get(struct nlattr **attrs, struct xfrm_mark *m) 2186{ 2187 if (attrs[XFRMA_MARK]) 2188 memcpy(m, nla_data(attrs[XFRMA_MARK]), sizeof(struct xfrm_mark)); 2189 else 2190 m->v = m->m = 0; 2191 2192 return m->v & m->m; 2193} 2194 2195static inline int xfrm_mark_put(struct sk_buff *skb, const struct xfrm_mark *m) 2196{ 2197 int ret = 0; 2198 2199 if (m->m | m->v) 2200 ret = nla_put(skb, XFRMA_MARK, sizeof(struct xfrm_mark), m); 2201 return ret; 2202} 2203 2204static inline __u32 xfrm_smark_get(__u32 mark, struct xfrm_state *x) 2205{ 2206 struct xfrm_mark *m = &x->props.smark; 2207 2208 return (m->v & m->m) | (mark & ~m->m); 2209} 2210 2211static inline int xfrm_if_id_put(struct sk_buff *skb, __u32 if_id) 2212{ 2213 int ret = 0; 2214 2215 if (if_id) 2216 ret = nla_put_u32(skb, XFRMA_IF_ID, if_id); 2217 return ret; 2218} 2219 2220static inline int xfrm_tunnel_check(struct sk_buff *skb, struct xfrm_state *x, 2221 unsigned int family) 2222{ 2223 bool tunnel = false; 2224 2225 switch(family) { 2226 case AF_INET: 2227 if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4) 2228 tunnel = true; 2229 break; 2230 case AF_INET6: 2231 if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6) 2232 tunnel = true; 2233 break; 2234 } 2235 if (tunnel && !(x->outer_mode.flags & XFRM_MODE_FLAG_TUNNEL)) 2236 return -EINVAL; 2237 2238 return 0; 2239} 2240 2241extern const int xfrm_msg_min[XFRM_NR_MSGTYPES]; 2242extern const struct nla_policy xfrma_policy[XFRMA_MAX+1]; 2243 2244struct xfrm_translator { 2245 /* Allocate frag_list and put compat translation there */ 2246 int (*alloc_compat)(struct sk_buff *skb, const struct nlmsghdr *src); 2247 2248 /* Allocate nlmsg with 64-bit translaton of received 32-bit message */ 2249 struct nlmsghdr *(*rcv_msg_compat)(const struct nlmsghdr *nlh, 2250 int maxtype, const struct nla_policy *policy, 2251 struct netlink_ext_ack *extack); 2252 2253 /* Translate 32-bit user_policy from sockptr */ 2254 int (*xlate_user_policy_sockptr)(u8 **pdata32, int optlen); 2255 2256 struct module *owner; 2257}; 2258 2259#if IS_ENABLED(CONFIG_XFRM_USER_COMPAT) 2260extern int xfrm_register_translator(struct xfrm_translator *xtr); 2261extern int xfrm_unregister_translator(struct xfrm_translator *xtr); 2262extern struct xfrm_translator *xfrm_get_translator(void); 2263extern void xfrm_put_translator(struct xfrm_translator *xtr); 2264#else 2265static inline struct xfrm_translator *xfrm_get_translator(void) 2266{ 2267 return NULL; 2268} 2269static inline void xfrm_put_translator(struct xfrm_translator *xtr) 2270{ 2271} 2272#endif 2273 2274#if IS_ENABLED(CONFIG_IPV6) 2275static inline bool xfrm6_local_dontfrag(const struct sock *sk) 2276{ 2277 int proto; 2278 2279 if (!sk || sk->sk_family != AF_INET6) 2280 return false; 2281 2282 proto = sk->sk_protocol; 2283 if (proto == IPPROTO_UDP || proto == IPPROTO_RAW) 2284 return inet6_test_bit(DONTFRAG, sk); 2285 2286 return false; 2287} 2288#endif 2289 2290#if (IS_BUILTIN(CONFIG_XFRM_INTERFACE) && IS_ENABLED(CONFIG_DEBUG_INFO_BTF)) || \ 2291 (IS_MODULE(CONFIG_XFRM_INTERFACE) && IS_ENABLED(CONFIG_DEBUG_INFO_BTF_MODULES)) 2292 2293extern struct metadata_dst __percpu *xfrm_bpf_md_dst; 2294 2295int register_xfrm_interface_bpf(void); 2296 2297#else 2298 2299static inline int register_xfrm_interface_bpf(void) 2300{ 2301 return 0; 2302} 2303 2304#endif 2305 2306#if IS_ENABLED(CONFIG_DEBUG_INFO_BTF) 2307int register_xfrm_state_bpf(void); 2308#else 2309static inline int register_xfrm_state_bpf(void) 2310{ 2311 return 0; 2312} 2313#endif 2314 2315int xfrm_nat_keepalive_init(unsigned short family); 2316void xfrm_nat_keepalive_fini(unsigned short family); 2317int xfrm_nat_keepalive_net_init(struct net *net); 2318int xfrm_nat_keepalive_net_fini(struct net *net); 2319void xfrm_nat_keepalive_state_updated(struct xfrm_state *x); 2320 2321#endif /* _NET_XFRM_H */
~/
Read-only file preview.