xfrm.h 49.2 KB
Newer Older
Linus Torvalds's avatar
Linus Torvalds committed
1
2
3
#ifndef _NET_XFRM_H
#define _NET_XFRM_H

Herbert Xu's avatar
Herbert Xu committed
4
#include <linux/compiler.h>
Linus Torvalds's avatar
Linus Torvalds committed
5
6
7
8
#include <linux/xfrm.h>
#include <linux/spinlock.h>
#include <linux/list.h>
#include <linux/skbuff.h>
9
#include <linux/socket.h>
Linus Torvalds's avatar
Linus Torvalds committed
10
#include <linux/pfkeyv2.h>
11
#include <linux/ipsec.h>
Linus Torvalds's avatar
Linus Torvalds committed
12
#include <linux/in6.h>
Arjan van de Ven's avatar
Arjan van de Ven committed
13
#include <linux/mutex.h>
Joy Latten's avatar
Joy Latten committed
14
#include <linux/audit.h>
15
#include <linux/slab.h>
Linus Torvalds's avatar
Linus Torvalds committed
16
17
18

#include <net/sock.h>
#include <net/dst.h>
19
#include <net/ip.h>
Linus Torvalds's avatar
Linus Torvalds committed
20
21
22
#include <net/route.h>
#include <net/ipv6.h>
#include <net/ip6_fib.h>
23
#include <net/flow.h>
24
25
26

#include <linux/interrupt.h>

27
28
29
#ifdef CONFIG_XFRM_STATISTICS
#include <net/snmp.h>
#endif
Linus Torvalds's avatar
Linus Torvalds committed
30

31
32
33
34
35
36
37
38
#define XFRM_PROTO_ESP		50
#define XFRM_PROTO_AH		51
#define XFRM_PROTO_COMP		108
#define XFRM_PROTO_IPIP		4
#define XFRM_PROTO_IPV6		41
#define XFRM_PROTO_ROUTING	IPPROTO_ROUTING
#define XFRM_PROTO_DSTOPTS	IPPROTO_DSTOPTS

39
#define XFRM_ALIGN4(len)	(((len) + 3) & ~3)
Linus Torvalds's avatar
Linus Torvalds committed
40
#define XFRM_ALIGN8(len)	(((len) + 7) & ~7)
41
42
#define MODULE_ALIAS_XFRM_MODE(family, encap) \
	MODULE_ALIAS("xfrm-mode-" __stringify(family) "-" __stringify(encap))
43
44
#define MODULE_ALIAS_XFRM_TYPE(family, proto) \
	MODULE_ALIAS("xfrm-type-" __stringify(family) "-" __stringify(proto))
Linus Torvalds's avatar
Linus Torvalds committed
45

46
#ifdef CONFIG_XFRM_STATISTICS
Alexey Dobriyan's avatar
Alexey Dobriyan committed
47
48
49
#define XFRM_INC_STATS(net, field)	SNMP_INC_STATS((net)->mib.xfrm_statistics, field)
#define XFRM_INC_STATS_BH(net, field)	SNMP_INC_STATS_BH((net)->mib.xfrm_statistics, field)
#define XFRM_INC_STATS_USER(net, field)	SNMP_INC_STATS_USER((net)-mib.xfrm_statistics, field)
50
#else
Alexey Dobriyan's avatar
Alexey Dobriyan committed
51
52
53
#define XFRM_INC_STATS(net, field)	((void)(net))
#define XFRM_INC_STATS_BH(net, field)	((void)(net))
#define XFRM_INC_STATS_USER(net, field)	((void)(net))
54
55
#endif

Linus Torvalds's avatar
Linus Torvalds committed
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117

/* Organization of SPD aka "XFRM rules"
   ------------------------------------

   Basic objects:
   - policy rule, struct xfrm_policy (=SPD entry)
   - bundle of transformations, struct dst_entry == struct xfrm_dst (=SA bundle)
   - instance of a transformer, struct xfrm_state (=SA)
   - template to clone xfrm_state, struct xfrm_tmpl

   SPD is plain linear list of xfrm_policy rules, ordered by priority.
   (To be compatible with existing pfkeyv2 implementations,
   many rules with priority of 0x7fffffff are allowed to exist and
   such rules are ordered in an unpredictable way, thanks to bsd folks.)

   Lookup is plain linear search until the first match with selector.

   If "action" is "block", then we prohibit the flow, otherwise:
   if "xfrms_nr" is zero, the flow passes untransformed. Otherwise,
   policy entry has list of up to XFRM_MAX_DEPTH transformations,
   described by templates xfrm_tmpl. Each template is resolved
   to a complete xfrm_state (see below) and we pack bundle of transformations
   to a dst_entry returned to requestor.

   dst -. xfrm  .-> xfrm_state #1
    |---. child .-> dst -. xfrm .-> xfrm_state #2
                     |---. child .-> dst -. xfrm .-> xfrm_state #3
                                      |---. child .-> NULL

   Bundles are cached at xrfm_policy struct (field ->bundles).


   Resolution of xrfm_tmpl
   -----------------------
   Template contains:
   1. ->mode		Mode: transport or tunnel
   2. ->id.proto	Protocol: AH/ESP/IPCOMP
   3. ->id.daddr	Remote tunnel endpoint, ignored for transport mode.
      Q: allow to resolve security gateway?
   4. ->id.spi          If not zero, static SPI.
   5. ->saddr		Local tunnel endpoint, ignored for transport mode.
   6. ->algos		List of allowed algos. Plain bitmask now.
      Q: ealgos, aalgos, calgos. What a mess...
   7. ->share		Sharing mode.
      Q: how to implement private sharing mode? To add struct sock* to
      flow id?

   Having this template we search through SAD searching for entries
   with appropriate mode/proto/algo, permitted by selector.
   If no appropriate entry found, it is requested from key manager.

   PROBLEMS:
   Q: How to find all the bundles referring to a physical path for
      PMTU discovery? Seems, dst should contain list of all parents...
      and enter to infinite locking hierarchy disaster.
      No! It is easier, we will not search for them, let them find us.
      We add genid to each dst plus pointer to genid of raw IP route,
      pmtu disc will update pmtu on raw IP route and increase its genid.
      dst_check() will see this for top level and trigger resyncing
      metrics. Plus, it will be made via sk->sk_dst_cache. Solved.
 */

118
119
120
struct xfrm_state_walk {
	struct list_head	all;
	u8			state;
121
122
	u8			dying;
	u8			proto;
123
	u32			seq;
124
	struct xfrm_address_filter *filter;
125
126
};

Linus Torvalds's avatar
Linus Torvalds committed
127
/* Full description of state of transformer. */
Eric Dumazet's avatar
Eric Dumazet committed
128
struct xfrm_state {
129
	possible_net_t		xs_net;
130
	union {
131
		struct hlist_node	gclist;
132
133
		struct hlist_node	bydst;
	};
134
135
	struct hlist_node	bysrc;
	struct hlist_node	byspi;
Linus Torvalds's avatar
Linus Torvalds committed
136
137
138
139
140
141

	atomic_t		refcnt;
	spinlock_t		lock;

	struct xfrm_id		id;
	struct xfrm_selector	sel;
142
	struct xfrm_mark	mark;
143
	u32			tfcpad;
Linus Torvalds's avatar
Linus Torvalds committed
144

145
146
	u32			genid;

147
148
	/* Key manager bits */
	struct xfrm_state_walk	km;
Linus Torvalds's avatar
Linus Torvalds committed
149
150
151
152
153
154
155
156
157
158
159
160

	/* Parameters of this state. */
	struct {
		u32		reqid;
		u8		mode;
		u8		replay_window;
		u8		aalgo, ealgo, calgo;
		u8		flags;
		u16		family;
		xfrm_address_t	saddr;
		int		header_len;
		int		trailer_len;
161
		u32		extra_flags;
Linus Torvalds's avatar
Linus Torvalds committed
162
163
164
165
166
	} props;

	struct xfrm_lifetime_cfg lft;

	/* Data for transformer */
167
	struct xfrm_algo_auth	*aalg;
Linus Torvalds's avatar
Linus Torvalds committed
168
169
	struct xfrm_algo	*ealg;
	struct xfrm_algo	*calg;
170
	struct xfrm_algo_aead	*aead;
171
	const char		*geniv;
Linus Torvalds's avatar
Linus Torvalds committed
172
173
174
175

	/* Data for encapsulator */
	struct xfrm_encap_tmpl	*encap;

176
177
178
	/* Data for care-of address */
	xfrm_address_t	*coaddr;

Linus Torvalds's avatar
Linus Torvalds committed
179
180
181
182
183
184
185
186
	/* IPComp needs an IPIP tunnel for handling uncompressed packets */
	struct xfrm_state	*tunnel;

	/* If a tunnel, number of users + 1 */
	atomic_t		tunnel_users;

	/* State for replay detection */
	struct xfrm_replay_state replay;
187
	struct xfrm_replay_state_esn *replay_esn;
Linus Torvalds's avatar
Linus Torvalds committed
188

189
190
	/* Replay detection state at the time we sent the last notification */
	struct xfrm_replay_state preplay;
191
	struct xfrm_replay_state_esn *preplay_esn;
192

193
194
195
	/* The functions for replay detection. */
	struct xfrm_replay	*repl;

Jamal Hadi Salim's avatar
Jamal Hadi Salim committed
196
197
198
199
200
	/* internal flag that only holds state for delayed aevent at the
	 * moment
	*/
	u32			xflags;

201
202
203
204
205
206
207
	/* Replay detection notification settings */
	u32			replay_maxage;
	u32			replay_maxdiff;

	/* Replay detection notification timer */
	struct timer_list	rtimer;

Linus Torvalds's avatar
Linus Torvalds committed
208
209
210
211
	/* Statistics */
	struct xfrm_stats	stats;

	struct xfrm_lifetime_cur curlft;
212
	struct tasklet_hrtimer	mtimer;
Linus Torvalds's avatar
Linus Torvalds committed
213

214
215
216
	/* used to fix curlft->add_time when changing date */
	long		saved_tmo;

217
	/* Last used time */
218
	unsigned long		lastused;
219

Linus Torvalds's avatar
Linus Torvalds committed
220
221
	/* Reference to data common to all the instances of this
	 * transformer. */
222
	const struct xfrm_type	*type;
223
	struct xfrm_mode	*inner_mode;
224
	struct xfrm_mode	*inner_mode_iaf;
225
	struct xfrm_mode	*outer_mode;
Linus Torvalds's avatar
Linus Torvalds committed
226

227
228
229
	/* Security context */
	struct xfrm_sec_ctx	*security;

Linus Torvalds's avatar
Linus Torvalds committed
230
231
232
233
234
	/* Private data of this transformer, format is opaque,
	 * interpreted by xfrm_type methods. */
	void			*data;
};

235
236
237
238
239
static inline struct net *xs_net(struct xfrm_state *x)
{
	return read_pnet(&x->xs_net);
}

Jamal Hadi Salim's avatar
Jamal Hadi Salim committed
240
241
/* xflags - make enum if more show up */
#define XFRM_TIME_DEFER	1
242
#define XFRM_SOFT_EXPIRE 2
Jamal Hadi Salim's avatar
Jamal Hadi Salim committed
243

Linus Torvalds's avatar
Linus Torvalds committed
244
245
246
247
248
249
250
251
252
enum {
	XFRM_STATE_VOID,
	XFRM_STATE_ACQ,
	XFRM_STATE_VALID,
	XFRM_STATE_ERROR,
	XFRM_STATE_EXPIRED,
	XFRM_STATE_DEAD
};

253
/* callback structure passed from either netlink or pfkey */
Eric Dumazet's avatar
Eric Dumazet committed
254
struct km_event {
255
256
257
258
	union {
		u32 hard;
		u32 proto;
		u32 byid;
259
		u32 aevent;
260
		u32 type;
261
262
	} data;

263
	u32	seq;
264
	u32	portid;
265
	u32	event;
266
	struct net *net;
267
268
};

269
270
271
272
273
struct xfrm_replay {
	void	(*advance)(struct xfrm_state *x, __be32 net_seq);
	int	(*check)(struct xfrm_state *x,
			 struct sk_buff *skb,
			 __be32 net_seq);
274
275
276
	int	(*recheck)(struct xfrm_state *x,
			   struct sk_buff *skb,
			   __be32 net_seq);
277
278
279
280
	void	(*notify)(struct xfrm_state *x, int event);
	int	(*overflow)(struct xfrm_state *x, struct sk_buff *skb);
};

281
struct net_device;
Linus Torvalds's avatar
Linus Torvalds committed
282
283
284
285
286
struct xfrm_type;
struct xfrm_dst;
struct xfrm_policy_afinfo {
	unsigned short		family;
	struct dst_ops		*dst_ops;
287
	void			(*garbage_collect)(struct net *net);
David Ahern's avatar
David Ahern committed
288
289
	struct dst_entry	*(*dst_lookup)(struct net *net,
					       int tos, int oif,
290
291
					       const xfrm_address_t *saddr,
					       const xfrm_address_t *daddr);
David Ahern's avatar
David Ahern committed
292
293
294
	int			(*get_saddr)(struct net *net, int oif,
					     xfrm_address_t *saddr,
					     xfrm_address_t *daddr);
Linus Torvalds's avatar
Linus Torvalds committed
295
	void			(*decode_session)(struct sk_buff *skb,
296
297
						  struct flowi *fl,
						  int reverse);
298
	int			(*get_tos)(const struct flowi *fl);
299
300
301
	int			(*init_path)(struct xfrm_dst *path,
					     struct dst_entry *dst,
					     int nfheader_len);
302
	int			(*fill_dst)(struct xfrm_dst *xdst,
Herbert Xu's avatar
Herbert Xu committed
303
					    struct net_device *dev,
304
					    const struct flowi *fl);
305
	struct dst_entry	*(*blackhole_route)(struct net *net, struct dst_entry *orig);
Linus Torvalds's avatar
Linus Torvalds committed
306
307
};

308
309
310
311
312
int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo);
int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo);
void km_policy_notify(struct xfrm_policy *xp, int dir,
		      const struct km_event *c);
void km_state_notify(struct xfrm_state *x, const struct km_event *c);
Linus Torvalds's avatar
Linus Torvalds committed
313
314

struct xfrm_tmpl;
315
316
317
318
int km_query(struct xfrm_state *x, struct xfrm_tmpl *t,
	     struct xfrm_policy *pol);
void km_state_expired(struct xfrm_state *x, int hard, u32 portid);
int __xfrm_state_delete(struct xfrm_state *x);
319

Linus Torvalds's avatar
Linus Torvalds committed
320
struct xfrm_state_afinfo {
321
	unsigned int		family;
322
	unsigned int		proto;
Al Viro's avatar
Al Viro committed
323
	__be16			eth_proto;
324
	struct module		*owner;
325
	const struct xfrm_type	*type_map[IPPROTO_MAX];
326
	struct xfrm_mode	*mode_map[XFRM_MODE_MAX];
327
	int			(*init_flags)(struct xfrm_state *x);
328
329
	void			(*init_tempsel)(struct xfrm_selector *sel,
						const struct flowi *fl);
330
331
332
333
	void			(*init_temprop)(struct xfrm_state *x,
						const struct xfrm_tmpl *tmpl,
						const xfrm_address_t *daddr,
						const xfrm_address_t *saddr);
334
335
	int			(*tmpl_sort)(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n);
	int			(*state_sort)(struct xfrm_state **dst, struct xfrm_state **src, int n);
336
	int			(*output)(struct sock *sk, struct sk_buff *skb);
337
	int			(*output_finish)(struct sock *sk, struct sk_buff *skb);
338
339
	int			(*extract_input)(struct xfrm_state *x,
						 struct sk_buff *skb);
340
341
	int			(*extract_output)(struct xfrm_state *x,
						  struct sk_buff *skb);
342
343
	int			(*transport_finish)(struct sk_buff *skb,
						    int async);
344
	void			(*local_error)(struct sk_buff *skb, u32 mtu);
Linus Torvalds's avatar
Linus Torvalds committed
345
346
};

347
348
349
350
int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo);
int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo);
struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family);
void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo);
Linus Torvalds's avatar
Linus Torvalds committed
351

352
353
354
355
356
357
358
359
360
361
struct xfrm_input_afinfo {
	unsigned int		family;
	struct module		*owner;
	int			(*callback)(struct sk_buff *skb, u8 protocol,
					    int err);
};

int xfrm_input_register_afinfo(struct xfrm_input_afinfo *afinfo);
int xfrm_input_unregister_afinfo(struct xfrm_input_afinfo *afinfo);

362
void xfrm_state_delete_tunnel(struct xfrm_state *x);
Linus Torvalds's avatar
Linus Torvalds committed
363

Eric Dumazet's avatar
Eric Dumazet committed
364
struct xfrm_type {
Linus Torvalds's avatar
Linus Torvalds committed
365
366
	char			*description;
	struct module		*owner;
jamal's avatar
jamal committed
367
368
	u8			proto;
	u8			flags;
369
#define XFRM_TYPE_NON_FRAGMENT	1
370
#define XFRM_TYPE_REPLAY_PROT	2
371
372
#define XFRM_TYPE_LOCAL_COADDR	4
#define XFRM_TYPE_REMOTE_COADDR	8
Linus Torvalds's avatar
Linus Torvalds committed
373

Herbert Xu's avatar
Herbert Xu committed
374
	int			(*init_state)(struct xfrm_state *x);
Linus Torvalds's avatar
Linus Torvalds committed
375
	void			(*destructor)(struct xfrm_state *);
376
	int			(*input)(struct xfrm_state *, struct sk_buff *skb);
Linus Torvalds's avatar
Linus Torvalds committed
377
	int			(*output)(struct xfrm_state *, struct sk_buff *pskb);
378
379
	int			(*reject)(struct xfrm_state *, struct sk_buff *,
					  const struct flowi *);
380
	int			(*hdr_offset)(struct xfrm_state *, struct sk_buff *, u8 **);
Linus Torvalds's avatar
Linus Torvalds committed
381
	/* Estimate maximal size of result of transformation of a dgram */
382
	u32			(*get_mtu)(struct xfrm_state *, int size);
Linus Torvalds's avatar
Linus Torvalds committed
383
384
};

385
386
int xfrm_register_type(const struct xfrm_type *type, unsigned short family);
int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family);
Linus Torvalds's avatar
Linus Torvalds committed
387

388
struct xfrm_mode {
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
	/*
	 * Remove encapsulation header.
	 *
	 * The IP header will be moved over the top of the encapsulation
	 * header.
	 *
	 * On entry, the transport header shall point to where the IP header
	 * should be and the network header shall be set to where the IP
	 * header currently is.  skb->data shall point to the start of the
	 * payload.
	 */
	int (*input2)(struct xfrm_state *x, struct sk_buff *skb);

	/*
	 * This is the actual input entry point.
	 *
	 * For transport mode and equivalent this would be identical to
	 * input2 (which does not need to be set).  While tunnel mode
	 * and equivalent would set this to the tunnel encapsulation function
	 * xfrm4_prepare_input that would in turn call input2.
	 */
410
	int (*input)(struct xfrm_state *x, struct sk_buff *skb);
411
412
413
414
415
416
417
418
419
420
421
422

	/*
	 * Add encapsulation header.
	 *
	 * On exit, the transport header will be set to the start of the
	 * encapsulation header to be filled in by x->type->output and
	 * the mac header will be set to the nextheader (protocol for
	 * IPv4) field of the extension header directly preceding the
	 * encapsulation header, or in its absence, that of the top IP
	 * header.  The value of the network header will always point
	 * to the top IP header while skb->data will point to the payload.
	 */
423
424
425
426
427
428
429
430
431
432
433
434
	int (*output2)(struct xfrm_state *x,struct sk_buff *skb);

	/*
	 * This is the actual output entry point.
	 *
	 * For transport mode and equivalent this would be identical to
	 * output2 (which does not need to be set).  While tunnel mode
	 * and equivalent would set this to a tunnel encapsulation function
	 * (xfrm4_prepare_output or xfrm6_prepare_output) that would in turn
	 * call output2.
	 */
	int (*output)(struct xfrm_state *x, struct sk_buff *skb);
435

436
	struct xfrm_state_afinfo *afinfo;
437
438
	struct module *owner;
	unsigned int encap;
Herbert Xu's avatar
Herbert Xu committed
439
440
441
442
443
444
	int flags;
};

/* Flags for xfrm_mode. */
enum {
	XFRM_MODE_FLAG_TUNNEL = 1,
445
446
};

447
448
int xfrm_register_mode(struct xfrm_mode *mode, int family);
int xfrm_unregister_mode(struct xfrm_mode *mode, int family);
449

450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
static inline int xfrm_af2proto(unsigned int family)
{
	switch(family) {
	case AF_INET:
		return IPPROTO_IPIP;
	case AF_INET6:
		return IPPROTO_IPV6;
	default:
		return 0;
	}
}

static inline struct xfrm_mode *xfrm_ip2inner_mode(struct xfrm_state *x, int ipproto)
{
	if ((ipproto == IPPROTO_IPIP && x->props.family == AF_INET) ||
	    (ipproto == IPPROTO_IPV6 && x->props.family == AF_INET6))
		return x->inner_mode;
	else
		return x->inner_mode_iaf;
}

Eric Dumazet's avatar
Eric Dumazet committed
471
struct xfrm_tmpl {
Linus Torvalds's avatar
Linus Torvalds committed
472
473
474
475
476
477
478
479
480
481
482
/* id in template is interpreted as:
 * daddr - destination of tunnel, may be zero for transport mode.
 * spi   - zero to acquire spi. Not zero if spi is static, then
 *	   daddr must be fixed too.
 * proto - AH/ESP/IPCOMP
 */
	struct xfrm_id		id;

/* Source address of tunnel. Ignored, if it is not a tunnel. */
	xfrm_address_t		saddr;

483
484
	unsigned short		encap_family;

jamal's avatar
jamal committed
485
	u32			reqid;
Linus Torvalds's avatar
Linus Torvalds committed
486

487
/* Mode: transport, tunnel etc. */
jamal's avatar
jamal committed
488
	u8			mode;
Linus Torvalds's avatar
Linus Torvalds committed
489
490

/* Sharing mode: unique, this session only, this user only etc. */
jamal's avatar
jamal committed
491
	u8			share;
Linus Torvalds's avatar
Linus Torvalds committed
492
493

/* May skip this transfomration if no SA is found */
jamal's avatar
jamal committed
494
	u8			optional;
Linus Torvalds's avatar
Linus Torvalds committed
495

496
/* Skip aalgos/ealgos/calgos checks. */
jamal's avatar
jamal committed
497
	u8			allalgs;
498

Linus Torvalds's avatar
Linus Torvalds committed
499
/* Bit mask of algos allowed for acquisition */
jamal's avatar
jamal committed
500
501
502
	u32			aalgos;
	u32			ealgos;
	u32			calgos;
Linus Torvalds's avatar
Linus Torvalds committed
503
504
};

505
#define XFRM_MAX_DEPTH		6
Linus Torvalds's avatar
Linus Torvalds committed
506

507
508
509
510
511
512
513
514
515
516
517
struct xfrm_policy_walk_entry {
	struct list_head	all;
	u8			dead;
};

struct xfrm_policy_walk {
	struct xfrm_policy_walk_entry walk;
	u8 type;
	u32 seq;
};

518
519
520
521
522
523
struct xfrm_policy_queue {
	struct sk_buff_head	hold_queue;
	struct timer_list	hold_timer;
	unsigned long		timeout;
};

Eric Dumazet's avatar
Eric Dumazet committed
524
struct xfrm_policy {
525
	possible_net_t		xp_net;
526
527
	struct hlist_node	bydst;
	struct hlist_node	byidx;
Linus Torvalds's avatar
Linus Torvalds committed
528
529
530
531
532
533

	/* This lock only affects elements except for entry. */
	rwlock_t		lock;
	atomic_t		refcnt;
	struct timer_list	timer;

534
	struct flow_cache_object flo;
535
	atomic_t		genid;
Linus Torvalds's avatar
Linus Torvalds committed
536
537
	u32			priority;
	u32			index;
538
	struct xfrm_mark	mark;
Linus Torvalds's avatar
Linus Torvalds committed
539
540
541
	struct xfrm_selector	selector;
	struct xfrm_lifetime_cfg lft;
	struct xfrm_lifetime_cur curlft;
542
	struct xfrm_policy_walk_entry walk;
543
	struct xfrm_policy_queue polq;
544
545
546
547
	u8			type;
	u8			action;
	u8			flags;
	u8			xfrm_nr;
548
	u16			family;
549
	struct xfrm_sec_ctx	*security;
Linus Torvalds's avatar
Linus Torvalds committed
550
551
552
	struct xfrm_tmpl       	xfrm_vec[XFRM_MAX_DEPTH];
};

553
static inline struct net *xp_net(const struct xfrm_policy *xp)
554
555
556
557
{
	return read_pnet(&xp->xp_net);
}

558
559
560
561
562
563
564
struct xfrm_kmaddress {
	xfrm_address_t          local;
	xfrm_address_t          remote;
	u32			reserved;
	u16			family;
};

565
566
567
568
569
570
571
572
573
574
575
576
577
struct xfrm_migrate {
	xfrm_address_t		old_daddr;
	xfrm_address_t		old_saddr;
	xfrm_address_t		new_daddr;
	xfrm_address_t		new_saddr;
	u8			proto;
	u8			mode;
	u16			reserved;
	u32			reqid;
	u16			old_family;
	u16			new_family;
};

578
579
580
581
582
583
584
585
586
587
588
#define XFRM_KM_TIMEOUT                30
/* what happened */
#define XFRM_REPLAY_UPDATE	XFRM_AE_CR
#define XFRM_REPLAY_TIMEOUT	XFRM_AE_CE

/* default aevent timeout in units of 100ms */
#define XFRM_AE_ETIME			10
/* Async Event timer multiplier */
#define XFRM_AE_ETH_M			10
/* default seq threshold size */
#define XFRM_AE_SEQT_SIZE		2
Linus Torvalds's avatar
Linus Torvalds committed
589

Eric Dumazet's avatar
Eric Dumazet committed
590
struct xfrm_mgr {
Linus Torvalds's avatar
Linus Torvalds committed
591
592
	struct list_head	list;
	char			*id;
593
	int			(*notify)(struct xfrm_state *x, const struct km_event *c);
594
	int			(*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp);
595
	struct xfrm_policy	*(*compile_policy)(struct sock *sk, int opt, u8 *data, int len, int *dir);
Al Viro's avatar
Al Viro committed
596
	int			(*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
597
	int			(*notify_policy)(struct xfrm_policy *x, int dir, const struct km_event *c);
598
	int			(*report)(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr);
599
600
601
602
603
	int			(*migrate)(const struct xfrm_selector *sel,
					   u8 dir, u8 type,
					   const struct xfrm_migrate *m,
					   int num_bundles,
					   const struct xfrm_kmaddress *k);
604
	bool			(*is_alive)(const struct km_event *c);
Linus Torvalds's avatar
Linus Torvalds committed
605
606
};

607
608
int xfrm_register_km(struct xfrm_mgr *km);
int xfrm_unregister_km(struct xfrm_mgr *km);
Linus Torvalds's avatar
Linus Torvalds committed
609

610
611
612
613
614
615
616
617
618
619
620
621
622
623
struct xfrm_tunnel_skb_cb {
	union {
		struct inet_skb_parm h4;
		struct inet6_skb_parm h6;
	} header;

	union {
		struct ip_tunnel *ip4;
		struct ip6_tnl *ip6;
	} tunnel;
};

#define XFRM_TUNNEL_SKB_CB(__skb) ((struct xfrm_tunnel_skb_cb *)&((__skb)->cb[0]))

624
625
626
627
628
629
/*
 * This structure is used for the duration where packets are being
 * transformed by IPsec.  As soon as the packet leaves IPsec the
 * area beyond the generic IP part may be overwritten.
 */
struct xfrm_skb_cb {
630
	struct xfrm_tunnel_skb_cb header;
631
632

        /* Sequence number for replay protection. */
633
	union {
634
635
636
637
638
639
640
641
		struct {
			__u32 low;
			__u32 hi;
		} output;
		struct {
			__be32 low;
			__be32 hi;
		} input;
642
	} seq;
643
644
645
646
};

#define XFRM_SKB_CB(__skb) ((struct xfrm_skb_cb *)&((__skb)->cb[0]))

647
648
649
650
651
/*
 * This structure is used by the afinfo prepare_input/prepare_output functions
 * to transmit header information to the mode input/output functions.
 */
struct xfrm_mode_skb_cb {
652
	struct xfrm_tunnel_skb_cb header;
653
654
655
656
657

	/* Copied from header for IPv4, always set to zero and DF for IPv6. */
	__be16 id;
	__be16 frag_off;

Herbert Xu's avatar
Herbert Xu committed
658
659
660
	/* IP header length (excluding options or extension headers). */
	u8 ihl;

661
662
663
664
665
666
667
668
669
	/* TOS for IPv4, class for IPv6. */
	u8 tos;

	/* TTL for IPv4, hop limitfor IPv6. */
	u8 ttl;

	/* Protocol for IPv4, NH for IPv6. */
	u8 protocol;

Herbert Xu's avatar
Herbert Xu committed
670
671
672
	/* Option length for IPv4, zero for IPv6. */
	u8 optlen;

673
674
675
676
677
678
	/* Used by IPv6 only, zero for IPv4. */
	u8 flow_lbl[3];
};

#define XFRM_MODE_SKB_CB(__skb) ((struct xfrm_mode_skb_cb *)&((__skb)->cb[0]))

679
680
681
682
683
/*
 * This structure is used by the input processing to locate the SPI and
 * related information.
 */
struct xfrm_spi_skb_cb {
684
	struct xfrm_tunnel_skb_cb header;
685
686

	unsigned int daddroff;
687
	unsigned int family;
688
689
690
691
};

#define XFRM_SPI_SKB_CB(__skb) ((struct xfrm_spi_skb_cb *)&((__skb)->cb[0]))

692
#ifdef CONFIG_AUDITSYSCALL
693
static inline struct audit_buffer *xfrm_audit_start(const char *op)
Joy Latten's avatar
Joy Latten committed
694
695
696
{
	struct audit_buffer *audit_buf = NULL;

697
698
	if (audit_enabled == 0)
		return NULL;
Joy Latten's avatar
Joy Latten committed
699
	audit_buf = audit_log_start(current->audit_context, GFP_ATOMIC,
700
				    AUDIT_MAC_IPSEC_EVENT);
Joy Latten's avatar
Joy Latten committed
701
702
	if (audit_buf == NULL)
		return NULL;
703
704
705
	audit_log_format(audit_buf, "op=%s", op);
	return audit_buf;
}
Joy Latten's avatar
Joy Latten committed
706

707
static inline void xfrm_audit_helper_usrinfo(bool task_valid,
708
709
					     struct audit_buffer *audit_buf)
{
710
711
712
713
714
715
716
	const unsigned int auid = from_kuid(&init_user_ns, task_valid ?
					    audit_get_loginuid(current) :
					    INVALID_UID);
	const unsigned int ses = task_valid ? audit_get_sessionid(current) :
		(unsigned int) -1;

	audit_log_format(audit_buf, " auid=%u ses=%u", auid, ses);
717
	audit_log_task_context(audit_buf);
Joy Latten's avatar
Joy Latten committed
718
719
}

720
721
722
723
724
void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, bool task_valid);
void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
			      bool task_valid);
void xfrm_audit_state_add(struct xfrm_state *x, int result, bool task_valid);
void xfrm_audit_state_delete(struct xfrm_state *x, int result, bool task_valid);
725
726
727
728
729
730
731
732
733
void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
				      struct sk_buff *skb);
void xfrm_audit_state_replay(struct xfrm_state *x, struct sk_buff *skb,
			     __be32 net_seq);
void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family);
void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, __be32 net_spi,
			       __be32 net_seq);
void xfrm_audit_state_icvfail(struct xfrm_state *x, struct sk_buff *skb,
			      u8 proto);
734
#else
735
736

static inline void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
737
					 bool task_valid)
738
739
740
741
{
}

static inline void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
742
					    bool task_valid)
743
744
745
746
{
}

static inline void xfrm_audit_state_add(struct xfrm_state *x, int result,
747
					bool task_valid)
748
749
750
751
{
}

static inline void xfrm_audit_state_delete(struct xfrm_state *x, int result,
752
					   bool task_valid)
753
754
755
756
757
758
759
760
{
}

static inline void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
					     struct sk_buff *skb)
{
}

761
762
763
764
765
static inline void xfrm_audit_state_replay(struct xfrm_state *x,
					   struct sk_buff *skb, __be32 net_seq)
{
}

766
767
768
769
770
771
772
773
774
775
776
777
778
779
static inline void xfrm_audit_state_notfound_simple(struct sk_buff *skb,
				      u16 family)
{
}

static inline void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
				      __be32 net_spi, __be32 net_seq)
{
}

static inline void xfrm_audit_state_icvfail(struct xfrm_state *x,
				     struct sk_buff *skb, u8 proto)
{
}
780
#endif /* CONFIG_AUDITSYSCALL */
Joy Latten's avatar
Joy Latten committed
781

Linus Torvalds's avatar
Linus Torvalds committed
782
783
784
785
786
787
static inline void xfrm_pol_hold(struct xfrm_policy *policy)
{
	if (likely(policy != NULL))
		atomic_inc(&policy->refcnt);
}

788
void xfrm_policy_destroy(struct xfrm_policy *policy);
Linus Torvalds's avatar
Linus Torvalds committed
789
790
791
792

static inline void xfrm_pol_put(struct xfrm_policy *policy)
{
	if (atomic_dec_and_test(&policy->refcnt))
793
		xfrm_policy_destroy(policy);
Linus Torvalds's avatar
Linus Torvalds committed
794
795
}

796
797
798
799
800
801
802
static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols)
{
	int i;
	for (i = npols - 1; i >= 0; --i)
		xfrm_pol_put(pols[i]);
}

803
void __xfrm_state_destroy(struct xfrm_state *);
Linus Torvalds's avatar
Linus Torvalds committed
804

805
806
807
808
809
static inline void __xfrm_state_put(struct xfrm_state *x)
{
	atomic_dec(&x->refcnt);
}

Linus Torvalds's avatar
Linus Torvalds committed
810
811
812
813
814
815
816
817
818
819
820
static inline void xfrm_state_put(struct xfrm_state *x)
{
	if (atomic_dec_and_test(&x->refcnt))
		__xfrm_state_destroy(x);
}

static inline void xfrm_state_hold(struct xfrm_state *x)
{
	atomic_inc(&x->refcnt);
}

821
822
static inline bool addr_match(const void *token1, const void *token2,
			      int prefixlen)
Linus Torvalds's avatar
Linus Torvalds committed
823
{
824
825
	const __be32 *a1 = token1;
	const __be32 *a2 = token2;
Linus Torvalds's avatar
Linus Torvalds committed
826
827
828
	int pdw;
	int pbi;

jamal's avatar
jamal committed
829
	pdw = prefixlen >> 5;	  /* num of whole u32 in prefix */
Linus Torvalds's avatar
Linus Torvalds committed
830
831
832
833
	pbi = prefixlen &  0x1f;  /* num of bits in incomplete u32 in prefix */

	if (pdw)
		if (memcmp(a1, a2, pdw << 2))
834
			return false;
Linus Torvalds's avatar
Linus Torvalds committed
835
836

	if (pbi) {
Al Viro's avatar
Al Viro committed
837
		__be32 mask;
Linus Torvalds's avatar
Linus Torvalds committed
838
839
840
841

		mask = htonl((0xffffffff) << (32 - pbi));

		if ((a1[pdw] ^ a2[pdw]) & mask)
842
			return false;
Linus Torvalds's avatar
Linus Torvalds committed
843
844
	}

845
	return true;
Linus Torvalds's avatar
Linus Torvalds committed
846
847
}

848
849
850
851
852
853
854
855
static inline bool addr4_match(__be32 a1, __be32 a2, u8 prefixlen)
{
	/* C99 6.5.7 (3): u32 << 32 is undefined behaviour */
	if (prefixlen == 0)
		return true;
	return !((a1 ^ a2) & htonl(0xFFFFFFFFu << (32 - prefixlen)));
}

Linus Torvalds's avatar
Linus Torvalds committed
856
static __inline__
857
__be16 xfrm_flowi_sport(const struct flowi *fl, const union flowi_uli *uli)
Linus Torvalds's avatar
Linus Torvalds committed
858
{
859
	__be16 port;
860
	switch(fl->flowi_proto) {
Linus Torvalds's avatar
Linus Torvalds committed
861
862
	case IPPROTO_TCP:
	case IPPROTO_UDP:
863
	case IPPROTO_UDPLITE:
Linus Torvalds's avatar
Linus Torvalds committed
864
	case IPPROTO_SCTP:
865
		port = uli->ports.sport;
Linus Torvalds's avatar
Linus Torvalds committed
866
867
868
		break;
	case IPPROTO_ICMP:
	case IPPROTO_ICMPV6:
869
		port = htons(uli->icmpt.type);
Linus Torvalds's avatar
Linus Torvalds committed
870
		break;
871
	case IPPROTO_MH:
872
		port = htons(uli->mht.type);
873
		break;
874
	case IPPROTO_GRE:
875
		port = htons(ntohl(uli->gre_key) >> 16);
876
		break;
Linus Torvalds's avatar
Linus Torvalds committed
877
878
879
880
881
882
883
	default:
		port = 0;	/*XXX*/
	}
	return port;
}

static __inline__
884
__be16 xfrm_flowi_dport(const struct flowi *fl, const union flowi_uli *uli)
Linus Torvalds's avatar
Linus Torvalds committed
885
{
886
	__be16 port;
887
	switch(fl->flowi_proto) {
Linus Torvalds's avatar
Linus Torvalds committed
888
889
	case IPPROTO_TCP:
	case IPPROTO_UDP:
890
	case IPPROTO_UDPLITE:
Linus Torvalds's avatar
Linus Torvalds committed
891
	case IPPROTO_SCTP:
892
		port = uli->ports.dport;
Linus Torvalds's avatar
Linus Torvalds committed
893
894
895
		break;
	case IPPROTO_ICMP:
	case IPPROTO_ICMPV6:
896
		port = htons(uli->icmpt.code);
Linus Torvalds's avatar
Linus Torvalds committed
897
		break;
898
	case IPPROTO_GRE:
899
		port = htons(ntohl(uli->gre_key) & 0xffff);
900
		break;
Linus Torvalds's avatar
Linus Torvalds committed
901
902
903
904
905
906
	default:
		port = 0;	/*XXX*/
	}
	return port;
}

907
908
bool xfrm_selector_match(const struct xfrm_selector *sel,
			 const struct flowi *fl, unsigned short family);
Linus Torvalds's avatar
Linus Torvalds committed
909

910
911
912
913
#ifdef CONFIG_SECURITY_NETWORK_XFRM
/*	If neither has a context --> match
 * 	Otherwise, both must have a context and the sids, doi, alg must match
 */
914
static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
915
916
917
918
919
920
921
922
{
	return ((!s1 && !s2) ||
		(s1 && s2 &&
		 (s1->ctx_sid == s2->ctx_sid) &&
		 (s1->ctx_doi == s2->ctx_doi) &&
		 (s1->ctx_alg == s2->ctx_alg)));
}
#else
923
static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
924
{
925
	return true;
926
927
928
}
#endif

Linus Torvalds's avatar
Linus Torvalds committed
929
930
931
932
933
934
935
936
937
938
939
/* A struct encoding bundle of transformations to apply to some set of flow.
 *
 * dst->child points to the next element of bundle.
 * dst->xfrm  points to an instanse of transformer.
 *
 * Due to unfortunate limitations of current routing cache, which we
 * have no time to fix, it mirrors struct rtable and bound to the same
 * routing key, including saddr,daddr. However, we can have many of
 * bundles differing by session id. All the bundles grow from a parent
 * policy rule.
 */
Eric Dumazet's avatar
Eric Dumazet committed
940
struct xfrm_dst {
Linus Torvalds's avatar
Linus Torvalds committed
941
942
943
944
945
946
	union {
		struct dst_entry	dst;
		struct rtable		rt;
		struct rt6_info		rt6;
	} u;
	struct dst_entry *route;
947
948
949
	struct flow_cache_object flo;
	struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX];
	int num_pols, num_xfrms;
950
951
952
953
#ifdef CONFIG_XFRM_SUB_POLICY
	struct flowi *origin;
	struct xfrm_selector *partner;
#endif
954
955
	u32 xfrm_genid;
	u32 policy_genid;
Linus Torvalds's avatar
Linus Torvalds committed
956
957
	u32 route_mtu_cached;
	u32 child_mtu_cached;
958
959
	u32 route_cookie;
	u32 path_cookie;
Linus Torvalds's avatar
Linus Torvalds committed
960
961
};

962
#ifdef CONFIG_XFRM
Herbert Xu's avatar
Herbert Xu committed
963
964
static inline void xfrm_dst_destroy(struct xfrm_dst *xdst)
{
965
	xfrm_pols_put(xdst->pols, xdst->num_pols);
Herbert Xu's avatar
Herbert Xu committed
966
967
968
	dst_release(xdst->route);
	if (likely(xdst->u.dst.xfrm))
		xfrm_state_put(xdst->u.dst.xfrm);
969
970
971
972
973
974
#ifdef CONFIG_XFRM_SUB_POLICY
	kfree(xdst->origin);
	xdst->origin = NULL;
	kfree(xdst->partner);
	xdst->partner = NULL;
#endif
Herbert Xu's avatar
Herbert Xu committed
975
}
976
#endif
Herbert Xu's avatar
Herbert Xu committed
977

978
void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev);
Herbert Xu's avatar
Herbert Xu committed
979

Eric Dumazet's avatar
Eric Dumazet committed
980
struct sec_path {
Linus Torvalds's avatar
Linus Torvalds committed
981
982
	atomic_t		refcnt;
	int			len;
983
	struct xfrm_state	*xvec[XFRM_MAX_DEPTH];
Linus Torvalds's avatar
Linus Torvalds committed
984
985
};

986
987
988
989
990
991
992
993
994
static inline int secpath_exists(struct sk_buff *skb)
{
#ifdef CONFIG_XFRM
	return skb->sp != NULL;
#else
	return 0;
#endif
}

Linus Torvalds's avatar
Linus Torvalds committed
995
996
997
998
999
1000
static inline struct sec_path *
secpath_get(struct sec_path *sp)
{
	if (sp)
		atomic_inc(&sp->refcnt);
	return sp;
For faster browsing, not all history is shown. View entire blame