1 /* SPDX-License-Identifier: GPL-2.0 */
2 #ifndef _NET_XFRM_H
3 #define _NET_XFRM_H
4 
5 #include <linux/compiler.h>
6 #include <linux/xfrm.h>
7 #include <linux/spinlock.h>
8 #include <linux/list.h>
9 #include <linux/skbuff.h>
10 #include <linux/socket.h>
11 #include <linux/pfkeyv2.h>
12 #include <linux/ipsec.h>
13 #include <linux/in6.h>
14 #include <linux/mutex.h>
15 #include <linux/audit.h>
16 #include <linux/slab.h>
17 #include <linux/refcount.h>
18 #include <linux/sockptr.h>
19 
20 #include <net/sock.h>
21 #include <net/dst.h>
22 #include <net/ip.h>
23 #include <net/route.h>
24 #include <net/ipv6.h>
25 #include <net/ip6_fib.h>
26 #include <net/flow.h>
27 #include <net/gro_cells.h>
28 
29 #include <linux/interrupt.h>
30 
31 #ifdef CONFIG_XFRM_STATISTICS
32 #include <net/snmp.h>
33 #endif
34 
35 #define XFRM_PROTO_ESP		50
36 #define XFRM_PROTO_AH		51
37 #define XFRM_PROTO_COMP		108
38 #define XFRM_PROTO_IPIP		4
39 #define XFRM_PROTO_IPV6		41
40 #define XFRM_PROTO_ROUTING	IPPROTO_ROUTING
41 #define XFRM_PROTO_DSTOPTS	IPPROTO_DSTOPTS
42 
43 #define XFRM_ALIGN4(len)	(((len) + 3) & ~3)
44 #define XFRM_ALIGN8(len)	(((len) + 7) & ~7)
45 #define MODULE_ALIAS_XFRM_MODE(family, encap) \
46 	MODULE_ALIAS("xfrm-mode-" __stringify(family) "-" __stringify(encap))
47 #define MODULE_ALIAS_XFRM_TYPE(family, proto) \
48 	MODULE_ALIAS("xfrm-type-" __stringify(family) "-" __stringify(proto))
49 #define MODULE_ALIAS_XFRM_OFFLOAD_TYPE(family, proto) \
50 	MODULE_ALIAS("xfrm-offload-" __stringify(family) "-" __stringify(proto))
51 
52 #ifdef CONFIG_XFRM_STATISTICS
53 #define XFRM_INC_STATS(net, field)	SNMP_INC_STATS((net)->mib.xfrm_statistics, field)
54 #else
55 #define XFRM_INC_STATS(net, field)	((void)(net))
56 #endif
57 
58 
59 /* Organization of SPD aka "XFRM rules"
60    ------------------------------------
61 
62    Basic objects:
63    - policy rule, struct xfrm_policy (=SPD entry)
64    - bundle of transformations, struct dst_entry == struct xfrm_dst (=SA bundle)
65    - instance of a transformer, struct xfrm_state (=SA)
66    - template to clone xfrm_state, struct xfrm_tmpl
67 
68    SPD is plain linear list of xfrm_policy rules, ordered by priority.
69    (To be compatible with existing pfkeyv2 implementations,
70    many rules with priority of 0x7fffffff are allowed to exist and
71    such rules are ordered in an unpredictable way, thanks to bsd folks.)
72 
73    Lookup is plain linear search until the first match with selector.
74 
75    If "action" is "block", then we prohibit the flow, otherwise:
76    if "xfrms_nr" is zero, the flow passes untransformed. Otherwise,
77    policy entry has list of up to XFRM_MAX_DEPTH transformations,
78    described by templates xfrm_tmpl. Each template is resolved
79    to a complete xfrm_state (see below) and we pack bundle of transformations
80    to a dst_entry returned to requestor.
81 
82    dst -. xfrm  .-> xfrm_state #1
83     |---. child .-> dst -. xfrm .-> xfrm_state #2
84                      |---. child .-> dst -. xfrm .-> xfrm_state #3
85                                       |---. child .-> NULL
86 
87    Bundles are cached at xrfm_policy struct (field ->bundles).
88 
89 
90    Resolution of xrfm_tmpl
91    -----------------------
92    Template contains:
93    1. ->mode		Mode: transport or tunnel
94    2. ->id.proto	Protocol: AH/ESP/IPCOMP
95    3. ->id.daddr	Remote tunnel endpoint, ignored for transport mode.
96       Q: allow to resolve security gateway?
97    4. ->id.spi          If not zero, static SPI.
98    5. ->saddr		Local tunnel endpoint, ignored for transport mode.
99    6. ->algos		List of allowed algos. Plain bitmask now.
100       Q: ealgos, aalgos, calgos. What a mess...
101    7. ->share		Sharing mode.
102       Q: how to implement private sharing mode? To add struct sock* to
103       flow id?
104 
105    Having this template we search through SAD searching for entries
106    with appropriate mode/proto/algo, permitted by selector.
107    If no appropriate entry found, it is requested from key manager.
108 
109    PROBLEMS:
110    Q: How to find all the bundles referring to a physical path for
111       PMTU discovery? Seems, dst should contain list of all parents...
112       and enter to infinite locking hierarchy disaster.
113       No! It is easier, we will not search for them, let them find us.
114       We add genid to each dst plus pointer to genid of raw IP route,
115       pmtu disc will update pmtu on raw IP route and increase its genid.
116       dst_check() will see this for top level and trigger resyncing
117       metrics. Plus, it will be made via sk->sk_dst_cache. Solved.
118  */
119 
120 struct xfrm_state_walk {
121 	struct list_head	all;
122 	u8			state;
123 	u8			dying;
124 	u8			proto;
125 	u32			seq;
126 	struct xfrm_address_filter *filter;
127 };
128 
129 enum {
130 	XFRM_DEV_OFFLOAD_IN = 1,
131 	XFRM_DEV_OFFLOAD_OUT,
132 	XFRM_DEV_OFFLOAD_FWD,
133 };
134 
135 enum {
136 	XFRM_DEV_OFFLOAD_UNSPECIFIED,
137 	XFRM_DEV_OFFLOAD_CRYPTO,
138 	XFRM_DEV_OFFLOAD_PACKET,
139 };
140 
141 enum {
142 	XFRM_DEV_OFFLOAD_FLAG_ACQ = 1,
143 };
144 
145 struct xfrm_dev_offload {
146 	struct net_device	*dev;
147 	netdevice_tracker	dev_tracker;
148 	struct net_device	*real_dev;
149 	unsigned long		offload_handle;
150 	u8			dir : 2;
151 	u8			type : 2;
152 	u8			flags : 2;
153 };
154 
155 struct xfrm_mode {
156 	u8 encap;
157 	u8 family;
158 	u8 flags;
159 };
160 
161 /* Flags for xfrm_mode. */
162 enum {
163 	XFRM_MODE_FLAG_TUNNEL = 1,
164 };
165 
166 enum xfrm_replay_mode {
167 	XFRM_REPLAY_MODE_LEGACY,
168 	XFRM_REPLAY_MODE_BMP,
169 	XFRM_REPLAY_MODE_ESN,
170 };
171 
172 /* Full description of state of transformer. */
173 struct xfrm_state {
174 	possible_net_t		xs_net;
175 	union {
176 		struct hlist_node	gclist;
177 		struct hlist_node	bydst;
178 	};
179 	struct hlist_node	bysrc;
180 	struct hlist_node	byspi;
181 	struct hlist_node	byseq;
182 
183 	refcount_t		refcnt;
184 	spinlock_t		lock;
185 
186 	struct xfrm_id		id;
187 	struct xfrm_selector	sel;
188 	struct xfrm_mark	mark;
189 	u32			if_id;
190 	u32			tfcpad;
191 
192 	u32			genid;
193 
194 	/* Key manager bits */
195 	struct xfrm_state_walk	km;
196 
197 	/* Parameters of this state. */
198 	struct {
199 		u32		reqid;
200 		u8		mode;
201 		u8		replay_window;
202 		u8		aalgo, ealgo, calgo;
203 		u8		flags;
204 		u16		family;
205 		xfrm_address_t	saddr;
206 		int		header_len;
207 		int		trailer_len;
208 		u32		extra_flags;
209 		struct xfrm_mark	smark;
210 	} props;
211 
212 	struct xfrm_lifetime_cfg lft;
213 
214 	/* Data for transformer */
215 	struct xfrm_algo_auth	*aalg;
216 	struct xfrm_algo	*ealg;
217 	struct xfrm_algo	*calg;
218 	struct xfrm_algo_aead	*aead;
219 	const char		*geniv;
220 
221 	/* mapping change rate limiting */
222 	__be16 new_mapping_sport;
223 	u32 new_mapping;	/* seconds */
224 	u32 mapping_maxage;	/* seconds for input SA */
225 
226 	/* Data for encapsulator */
227 	struct xfrm_encap_tmpl	*encap;
228 	struct sock __rcu	*encap_sk;
229 
230 	/* Data for care-of address */
231 	xfrm_address_t	*coaddr;
232 
233 	/* IPComp needs an IPIP tunnel for handling uncompressed packets */
234 	struct xfrm_state	*tunnel;
235 
236 	/* If a tunnel, number of users + 1 */
237 	atomic_t		tunnel_users;
238 
239 	/* State for replay detection */
240 	struct xfrm_replay_state replay;
241 	struct xfrm_replay_state_esn *replay_esn;
242 
243 	/* Replay detection state at the time we sent the last notification */
244 	struct xfrm_replay_state preplay;
245 	struct xfrm_replay_state_esn *preplay_esn;
246 
247 	/* replay detection mode */
248 	enum xfrm_replay_mode    repl_mode;
249 	/* internal flag that only holds state for delayed aevent at the
250 	 * moment
251 	*/
252 	u32			xflags;
253 
254 	/* Replay detection notification settings */
255 	u32			replay_maxage;
256 	u32			replay_maxdiff;
257 
258 	/* Replay detection notification timer */
259 	struct timer_list	rtimer;
260 
261 	/* Statistics */
262 	struct xfrm_stats	stats;
263 
264 	struct xfrm_lifetime_cur curlft;
265 	struct hrtimer		mtimer;
266 
267 	struct xfrm_dev_offload xso;
268 
269 	/* used to fix curlft->add_time when changing date */
270 	long		saved_tmo;
271 
272 	/* Last used time */
273 	time64_t		lastused;
274 
275 	struct page_frag xfrag;
276 
277 	/* Reference to data common to all the instances of this
278 	 * transformer. */
279 	const struct xfrm_type	*type;
280 	struct xfrm_mode	inner_mode;
281 	struct xfrm_mode	inner_mode_iaf;
282 	struct xfrm_mode	outer_mode;
283 
284 	const struct xfrm_type_offload	*type_offload;
285 
286 	/* Security context */
287 	struct xfrm_sec_ctx	*security;
288 
289 	/* Private data of this transformer, format is opaque,
290 	 * interpreted by xfrm_type methods. */
291 	void			*data;
292 };
293 
xs_net(struct xfrm_state * x)294 static inline struct net *xs_net(struct xfrm_state *x)
295 {
296 	return read_pnet(&x->xs_net);
297 }
298 
299 /* xflags - make enum if more show up */
300 #define XFRM_TIME_DEFER	1
301 #define XFRM_SOFT_EXPIRE 2
302 
303 enum {
304 	XFRM_STATE_VOID,
305 	XFRM_STATE_ACQ,
306 	XFRM_STATE_VALID,
307 	XFRM_STATE_ERROR,
308 	XFRM_STATE_EXPIRED,
309 	XFRM_STATE_DEAD
310 };
311 
312 /* callback structure passed from either netlink or pfkey */
313 struct km_event {
314 	union {
315 		u32 hard;
316 		u32 proto;
317 		u32 byid;
318 		u32 aevent;
319 		u32 type;
320 	} data;
321 
322 	u32	seq;
323 	u32	portid;
324 	u32	event;
325 	struct net *net;
326 };
327 
328 struct xfrm_if_decode_session_result {
329 	struct net *net;
330 	u32 if_id;
331 };
332 
333 struct xfrm_if_cb {
334 	bool (*decode_session)(struct sk_buff *skb,
335 			       unsigned short family,
336 			       struct xfrm_if_decode_session_result *res);
337 };
338 
339 void xfrm_if_register_cb(const struct xfrm_if_cb *ifcb);
340 void xfrm_if_unregister_cb(void);
341 
342 struct net_device;
343 struct xfrm_type;
344 struct xfrm_dst;
345 struct xfrm_policy_afinfo {
346 	struct dst_ops		*dst_ops;
347 	struct dst_entry	*(*dst_lookup)(struct net *net,
348 					       int tos, int oif,
349 					       const xfrm_address_t *saddr,
350 					       const xfrm_address_t *daddr,
351 					       u32 mark);
352 	int			(*get_saddr)(struct net *net, int oif,
353 					     xfrm_address_t *saddr,
354 					     xfrm_address_t *daddr,
355 					     u32 mark);
356 	int			(*fill_dst)(struct xfrm_dst *xdst,
357 					    struct net_device *dev,
358 					    const struct flowi *fl);
359 	struct dst_entry	*(*blackhole_route)(struct net *net, struct dst_entry *orig);
360 };
361 
362 int xfrm_policy_register_afinfo(const struct xfrm_policy_afinfo *afinfo, int family);
363 void xfrm_policy_unregister_afinfo(const struct xfrm_policy_afinfo *afinfo);
364 void km_policy_notify(struct xfrm_policy *xp, int dir,
365 		      const struct km_event *c);
366 void km_state_notify(struct xfrm_state *x, const struct km_event *c);
367 
368 struct xfrm_tmpl;
369 int km_query(struct xfrm_state *x, struct xfrm_tmpl *t,
370 	     struct xfrm_policy *pol);
371 void km_state_expired(struct xfrm_state *x, int hard, u32 portid);
372 int __xfrm_state_delete(struct xfrm_state *x);
373 
374 struct xfrm_state_afinfo {
375 	u8				family;
376 	u8				proto;
377 
378 	const struct xfrm_type_offload *type_offload_esp;
379 
380 	const struct xfrm_type		*type_esp;
381 	const struct xfrm_type		*type_ipip;
382 	const struct xfrm_type		*type_ipip6;
383 	const struct xfrm_type		*type_comp;
384 	const struct xfrm_type		*type_ah;
385 	const struct xfrm_type		*type_routing;
386 	const struct xfrm_type		*type_dstopts;
387 
388 	int			(*output)(struct net *net, struct sock *sk, struct sk_buff *skb);
389 	int			(*transport_finish)(struct sk_buff *skb,
390 						    int async);
391 	void			(*local_error)(struct sk_buff *skb, u32 mtu);
392 };
393 
394 int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo);
395 int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo);
396 struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family);
397 struct xfrm_state_afinfo *xfrm_state_afinfo_get_rcu(unsigned int family);
398 
399 struct xfrm_input_afinfo {
400 	u8			family;
401 	bool			is_ipip;
402 	int			(*callback)(struct sk_buff *skb, u8 protocol,
403 					    int err);
404 };
405 
406 int xfrm_input_register_afinfo(const struct xfrm_input_afinfo *afinfo);
407 int xfrm_input_unregister_afinfo(const struct xfrm_input_afinfo *afinfo);
408 
409 void xfrm_flush_gc(void);
410 void xfrm_state_delete_tunnel(struct xfrm_state *x);
411 
412 struct xfrm_type {
413 	struct module		*owner;
414 	u8			proto;
415 	u8			flags;
416 #define XFRM_TYPE_NON_FRAGMENT	1
417 #define XFRM_TYPE_REPLAY_PROT	2
418 #define XFRM_TYPE_LOCAL_COADDR	4
419 #define XFRM_TYPE_REMOTE_COADDR	8
420 
421 	int			(*init_state)(struct xfrm_state *x,
422 					      struct netlink_ext_ack *extack);
423 	void			(*destructor)(struct xfrm_state *);
424 	int			(*input)(struct xfrm_state *, struct sk_buff *skb);
425 	int			(*output)(struct xfrm_state *, struct sk_buff *pskb);
426 	int			(*reject)(struct xfrm_state *, struct sk_buff *,
427 					  const struct flowi *);
428 };
429 
430 int xfrm_register_type(const struct xfrm_type *type, unsigned short family);
431 void xfrm_unregister_type(const struct xfrm_type *type, unsigned short family);
432 
433 struct xfrm_type_offload {
434 	struct module	*owner;
435 	u8		proto;
436 	void		(*encap)(struct xfrm_state *, struct sk_buff *pskb);
437 	int		(*input_tail)(struct xfrm_state *x, struct sk_buff *skb);
438 	int		(*xmit)(struct xfrm_state *, struct sk_buff *pskb, netdev_features_t features);
439 };
440 
441 int xfrm_register_type_offload(const struct xfrm_type_offload *type, unsigned short family);
442 void xfrm_unregister_type_offload(const struct xfrm_type_offload *type, unsigned short family);
443 
xfrm_af2proto(unsigned int family)444 static inline int xfrm_af2proto(unsigned int family)
445 {
446 	switch(family) {
447 	case AF_INET:
448 		return IPPROTO_IPIP;
449 	case AF_INET6:
450 		return IPPROTO_IPV6;
451 	default:
452 		return 0;
453 	}
454 }
455 
xfrm_ip2inner_mode(struct xfrm_state * x,int ipproto)456 static inline const struct xfrm_mode *xfrm_ip2inner_mode(struct xfrm_state *x, int ipproto)
457 {
458 	if ((ipproto == IPPROTO_IPIP && x->props.family == AF_INET) ||
459 	    (ipproto == IPPROTO_IPV6 && x->props.family == AF_INET6))
460 		return &x->inner_mode;
461 	else
462 		return &x->inner_mode_iaf;
463 }
464 
465 struct xfrm_tmpl {
466 /* id in template is interpreted as:
467  * daddr - destination of tunnel, may be zero for transport mode.
468  * spi   - zero to acquire spi. Not zero if spi is static, then
469  *	   daddr must be fixed too.
470  * proto - AH/ESP/IPCOMP
471  */
472 	struct xfrm_id		id;
473 
474 /* Source address of tunnel. Ignored, if it is not a tunnel. */
475 	xfrm_address_t		saddr;
476 
477 	unsigned short		encap_family;
478 
479 	u32			reqid;
480 
481 /* Mode: transport, tunnel etc. */
482 	u8			mode;
483 
484 /* Sharing mode: unique, this session only, this user only etc. */
485 	u8			share;
486 
487 /* May skip this transfomration if no SA is found */
488 	u8			optional;
489 
490 /* Skip aalgos/ealgos/calgos checks. */
491 	u8			allalgs;
492 
493 /* Bit mask of algos allowed for acquisition */
494 	u32			aalgos;
495 	u32			ealgos;
496 	u32			calgos;
497 };
498 
499 #define XFRM_MAX_DEPTH		6
500 #define XFRM_MAX_OFFLOAD_DEPTH	1
501 
502 struct xfrm_policy_walk_entry {
503 	struct list_head	all;
504 	u8			dead;
505 };
506 
507 struct xfrm_policy_walk {
508 	struct xfrm_policy_walk_entry walk;
509 	u8 type;
510 	u32 seq;
511 };
512 
513 struct xfrm_policy_queue {
514 	struct sk_buff_head	hold_queue;
515 	struct timer_list	hold_timer;
516 	unsigned long		timeout;
517 };
518 
519 struct xfrm_policy {
520 	possible_net_t		xp_net;
521 	struct hlist_node	bydst;
522 	struct hlist_node	byidx;
523 
524 	/* This lock only affects elements except for entry. */
525 	rwlock_t		lock;
526 	refcount_t		refcnt;
527 	u32			pos;
528 	struct timer_list	timer;
529 
530 	atomic_t		genid;
531 	u32			priority;
532 	u32			index;
533 	u32			if_id;
534 	struct xfrm_mark	mark;
535 	struct xfrm_selector	selector;
536 	struct xfrm_lifetime_cfg lft;
537 	struct xfrm_lifetime_cur curlft;
538 	struct xfrm_policy_walk_entry walk;
539 	struct xfrm_policy_queue polq;
540 	bool                    bydst_reinsert;
541 	u8			type;
542 	u8			action;
543 	u8			flags;
544 	u8			xfrm_nr;
545 	u16			family;
546 	struct xfrm_sec_ctx	*security;
547 	struct xfrm_tmpl       	xfrm_vec[XFRM_MAX_DEPTH];
548 	struct hlist_node	bydst_inexact_list;
549 	struct rcu_head		rcu;
550 
551 	struct xfrm_dev_offload xdo;
552 };
553 
xp_net(const struct xfrm_policy * xp)554 static inline struct net *xp_net(const struct xfrm_policy *xp)
555 {
556 	return read_pnet(&xp->xp_net);
557 }
558 
559 struct xfrm_kmaddress {
560 	xfrm_address_t          local;
561 	xfrm_address_t          remote;
562 	u32			reserved;
563 	u16			family;
564 };
565 
566 struct xfrm_migrate {
567 	xfrm_address_t		old_daddr;
568 	xfrm_address_t		old_saddr;
569 	xfrm_address_t		new_daddr;
570 	xfrm_address_t		new_saddr;
571 	u8			proto;
572 	u8			mode;
573 	u16			reserved;
574 	u32			reqid;
575 	u16			old_family;
576 	u16			new_family;
577 };
578 
579 #define XFRM_KM_TIMEOUT                30
580 /* what happened */
581 #define XFRM_REPLAY_UPDATE	XFRM_AE_CR
582 #define XFRM_REPLAY_TIMEOUT	XFRM_AE_CE
583 
584 /* default aevent timeout in units of 100ms */
585 #define XFRM_AE_ETIME			10
586 /* Async Event timer multiplier */
587 #define XFRM_AE_ETH_M			10
588 /* default seq threshold size */
589 #define XFRM_AE_SEQT_SIZE		2
590 
591 struct xfrm_mgr {
592 	struct list_head	list;
593 	int			(*notify)(struct xfrm_state *x, const struct km_event *c);
594 	int			(*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp);
595 	struct xfrm_policy	*(*compile_policy)(struct sock *sk, int opt, u8 *data, int len, int *dir);
596 	int			(*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
597 	int			(*notify_policy)(struct xfrm_policy *x, int dir, const struct km_event *c);
598 	int			(*report)(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr);
599 	int			(*migrate)(const struct xfrm_selector *sel,
600 					   u8 dir, u8 type,
601 					   const struct xfrm_migrate *m,
602 					   int num_bundles,
603 					   const struct xfrm_kmaddress *k,
604 					   const struct xfrm_encap_tmpl *encap);
605 	bool			(*is_alive)(const struct km_event *c);
606 };
607 
608 void xfrm_register_km(struct xfrm_mgr *km);
609 void xfrm_unregister_km(struct xfrm_mgr *km);
610 
611 struct xfrm_tunnel_skb_cb {
612 	union {
613 		struct inet_skb_parm h4;
614 		struct inet6_skb_parm h6;
615 	} header;
616 
617 	union {
618 		struct ip_tunnel *ip4;
619 		struct ip6_tnl *ip6;
620 	} tunnel;
621 };
622 
623 #define XFRM_TUNNEL_SKB_CB(__skb) ((struct xfrm_tunnel_skb_cb *)&((__skb)->cb[0]))
624 
625 /*
626  * This structure is used for the duration where packets are being
627  * transformed by IPsec.  As soon as the packet leaves IPsec the
628  * area beyond the generic IP part may be overwritten.
629  */
630 struct xfrm_skb_cb {
631 	struct xfrm_tunnel_skb_cb header;
632 
633         /* Sequence number for replay protection. */
634 	union {
635 		struct {
636 			__u32 low;
637 			__u32 hi;
638 		} output;
639 		struct {
640 			__be32 low;
641 			__be32 hi;
642 		} input;
643 	} seq;
644 };
645 
646 #define XFRM_SKB_CB(__skb) ((struct xfrm_skb_cb *)&((__skb)->cb[0]))
647 
648 /*
649  * This structure is used by the afinfo prepare_input/prepare_output functions
650  * to transmit header information to the mode input/output functions.
651  */
652 struct xfrm_mode_skb_cb {
653 	struct xfrm_tunnel_skb_cb header;
654 
655 	/* Copied from header for IPv4, always set to zero and DF for IPv6. */
656 	__be16 id;
657 	__be16 frag_off;
658 
659 	/* IP header length (excluding options or extension headers). */
660 	u8 ihl;
661 
662 	/* TOS for IPv4, class for IPv6. */
663 	u8 tos;
664 
665 	/* TTL for IPv4, hop limitfor IPv6. */
666 	u8 ttl;
667 
668 	/* Protocol for IPv4, NH for IPv6. */
669 	u8 protocol;
670 
671 	/* Option length for IPv4, zero for IPv6. */
672 	u8 optlen;
673 
674 	/* Used by IPv6 only, zero for IPv4. */
675 	u8 flow_lbl[3];
676 };
677 
678 #define XFRM_MODE_SKB_CB(__skb) ((struct xfrm_mode_skb_cb *)&((__skb)->cb[0]))
679 
680 /*
681  * This structure is used by the input processing to locate the SPI and
682  * related information.
683  */
684 struct xfrm_spi_skb_cb {
685 	struct xfrm_tunnel_skb_cb header;
686 
687 	unsigned int daddroff;
688 	unsigned int family;
689 	__be32 seq;
690 };
691 
692 #define XFRM_SPI_SKB_CB(__skb) ((struct xfrm_spi_skb_cb *)&((__skb)->cb[0]))
693 
694 #ifdef CONFIG_AUDITSYSCALL
xfrm_audit_start(const char * op)695 static inline struct audit_buffer *xfrm_audit_start(const char *op)
696 {
697 	struct audit_buffer *audit_buf = NULL;
698 
699 	if (audit_enabled == AUDIT_OFF)
700 		return NULL;
701 	audit_buf = audit_log_start(audit_context(), GFP_ATOMIC,
702 				    AUDIT_MAC_IPSEC_EVENT);
703 	if (audit_buf == NULL)
704 		return NULL;
705 	audit_log_format(audit_buf, "op=%s", op);
706 	return audit_buf;
707 }
708 
xfrm_audit_helper_usrinfo(bool task_valid,struct audit_buffer * audit_buf)709 static inline void xfrm_audit_helper_usrinfo(bool task_valid,
710 					     struct audit_buffer *audit_buf)
711 {
712 	const unsigned int auid = from_kuid(&init_user_ns, task_valid ?
713 					    audit_get_loginuid(current) :
714 					    INVALID_UID);
715 	const unsigned int ses = task_valid ? audit_get_sessionid(current) :
716 		AUDIT_SID_UNSET;
717 
718 	audit_log_format(audit_buf, " auid=%u ses=%u", auid, ses);
719 	audit_log_task_context(audit_buf);
720 }
721 
722 void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, bool task_valid);
723 void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
724 			      bool task_valid);
725 void xfrm_audit_state_add(struct xfrm_state *x, int result, bool task_valid);
726 void xfrm_audit_state_delete(struct xfrm_state *x, int result, bool task_valid);
727 void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
728 				      struct sk_buff *skb);
729 void xfrm_audit_state_replay(struct xfrm_state *x, struct sk_buff *skb,
730 			     __be32 net_seq);
731 void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family);
732 void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, __be32 net_spi,
733 			       __be32 net_seq);
734 void xfrm_audit_state_icvfail(struct xfrm_state *x, struct sk_buff *skb,
735 			      u8 proto);
736 #else
737 
xfrm_audit_policy_add(struct xfrm_policy * xp,int result,bool task_valid)738 static inline void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
739 					 bool task_valid)
740 {
741 }
742 
xfrm_audit_policy_delete(struct xfrm_policy * xp,int result,bool task_valid)743 static inline void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
744 					    bool task_valid)
745 {
746 }
747 
xfrm_audit_state_add(struct xfrm_state * x,int result,bool task_valid)748 static inline void xfrm_audit_state_add(struct xfrm_state *x, int result,
749 					bool task_valid)
750 {
751 }
752 
xfrm_audit_state_delete(struct xfrm_state * x,int result,bool task_valid)753 static inline void xfrm_audit_state_delete(struct xfrm_state *x, int result,
754 					   bool task_valid)
755 {
756 }
757 
xfrm_audit_state_replay_overflow(struct xfrm_state * x,struct sk_buff * skb)758 static inline void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
759 					     struct sk_buff *skb)
760 {
761 }
762 
xfrm_audit_state_replay(struct xfrm_state * x,struct sk_buff * skb,__be32 net_seq)763 static inline void xfrm_audit_state_replay(struct xfrm_state *x,
764 					   struct sk_buff *skb, __be32 net_seq)
765 {
766 }
767 
xfrm_audit_state_notfound_simple(struct sk_buff * skb,u16 family)768 static inline void xfrm_audit_state_notfound_simple(struct sk_buff *skb,
769 				      u16 family)
770 {
771 }
772 
xfrm_audit_state_notfound(struct sk_buff * skb,u16 family,__be32 net_spi,__be32 net_seq)773 static inline void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
774 				      __be32 net_spi, __be32 net_seq)
775 {
776 }
777 
xfrm_audit_state_icvfail(struct xfrm_state * x,struct sk_buff * skb,u8 proto)778 static inline void xfrm_audit_state_icvfail(struct xfrm_state *x,
779 				     struct sk_buff *skb, u8 proto)
780 {
781 }
782 #endif /* CONFIG_AUDITSYSCALL */
783 
xfrm_pol_hold(struct xfrm_policy * policy)784 static inline void xfrm_pol_hold(struct xfrm_policy *policy)
785 {
786 	if (likely(policy != NULL))
787 		refcount_inc(&policy->refcnt);
788 }
789 
790 void xfrm_policy_destroy(struct xfrm_policy *policy);
791 
xfrm_pol_put(struct xfrm_policy * policy)792 static inline void xfrm_pol_put(struct xfrm_policy *policy)
793 {
794 	if (refcount_dec_and_test(&policy->refcnt))
795 		xfrm_policy_destroy(policy);
796 }
797 
xfrm_pols_put(struct xfrm_policy ** pols,int npols)798 static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols)
799 {
800 	int i;
801 	for (i = npols - 1; i >= 0; --i)
802 		xfrm_pol_put(pols[i]);
803 }
804 
805 void __xfrm_state_destroy(struct xfrm_state *, bool);
806 
__xfrm_state_put(struct xfrm_state * x)807 static inline void __xfrm_state_put(struct xfrm_state *x)
808 {
809 	refcount_dec(&x->refcnt);
810 }
811 
xfrm_state_put(struct xfrm_state * x)812 static inline void xfrm_state_put(struct xfrm_state *x)
813 {
814 	if (refcount_dec_and_test(&x->refcnt))
815 		__xfrm_state_destroy(x, false);
816 }
817 
xfrm_state_put_sync(struct xfrm_state * x)818 static inline void xfrm_state_put_sync(struct xfrm_state *x)
819 {
820 	if (refcount_dec_and_test(&x->refcnt))
821 		__xfrm_state_destroy(x, true);
822 }
823 
xfrm_state_hold(struct xfrm_state * x)824 static inline void xfrm_state_hold(struct xfrm_state *x)
825 {
826 	refcount_inc(&x->refcnt);
827 }
828 
addr_match(const void * token1,const void * token2,unsigned int prefixlen)829 static inline bool addr_match(const void *token1, const void *token2,
830 			      unsigned int prefixlen)
831 {
832 	const __be32 *a1 = token1;
833 	const __be32 *a2 = token2;
834 	unsigned int pdw;
835 	unsigned int pbi;
836 
837 	pdw = prefixlen >> 5;	  /* num of whole u32 in prefix */
838 	pbi = prefixlen &  0x1f;  /* num of bits in incomplete u32 in prefix */
839 
840 	if (pdw)
841 		if (memcmp(a1, a2, pdw << 2))
842 			return false;
843 
844 	if (pbi) {
845 		__be32 mask;
846 
847 		mask = htonl((0xffffffff) << (32 - pbi));
848 
849 		if ((a1[pdw] ^ a2[pdw]) & mask)
850 			return false;
851 	}
852 
853 	return true;
854 }
855 
addr4_match(__be32 a1,__be32 a2,u8 prefixlen)856 static inline bool addr4_match(__be32 a1, __be32 a2, u8 prefixlen)
857 {
858 	/* C99 6.5.7 (3): u32 << 32 is undefined behaviour */
859 	if (sizeof(long) == 4 && prefixlen == 0)
860 		return true;
861 	return !((a1 ^ a2) & htonl(~0UL << (32 - prefixlen)));
862 }
863 
864 static __inline__
xfrm_flowi_sport(const struct flowi * fl,const union flowi_uli * uli)865 __be16 xfrm_flowi_sport(const struct flowi *fl, const union flowi_uli *uli)
866 {
867 	__be16 port;
868 	switch(fl->flowi_proto) {
869 	case IPPROTO_TCP:
870 	case IPPROTO_UDP:
871 	case IPPROTO_UDPLITE:
872 	case IPPROTO_SCTP:
873 		port = uli->ports.sport;
874 		break;
875 	case IPPROTO_ICMP:
876 	case IPPROTO_ICMPV6:
877 		port = htons(uli->icmpt.type);
878 		break;
879 	case IPPROTO_MH:
880 		port = htons(uli->mht.type);
881 		break;
882 	case IPPROTO_GRE:
883 		port = htons(ntohl(uli->gre_key) >> 16);
884 		break;
885 	default:
886 		port = 0;	/*XXX*/
887 	}
888 	return port;
889 }
890 
891 static __inline__
xfrm_flowi_dport(const struct flowi * fl,const union flowi_uli * uli)892 __be16 xfrm_flowi_dport(const struct flowi *fl, const union flowi_uli *uli)
893 {
894 	__be16 port;
895 	switch(fl->flowi_proto) {
896 	case IPPROTO_TCP:
897 	case IPPROTO_UDP:
898 	case IPPROTO_UDPLITE:
899 	case IPPROTO_SCTP:
900 		port = uli->ports.dport;
901 		break;
902 	case IPPROTO_ICMP:
903 	case IPPROTO_ICMPV6:
904 		port = htons(uli->icmpt.code);
905 		break;
906 	case IPPROTO_GRE:
907 		port = htons(ntohl(uli->gre_key) & 0xffff);
908 		break;
909 	default:
910 		port = 0;	/*XXX*/
911 	}
912 	return port;
913 }
914 
915 bool xfrm_selector_match(const struct xfrm_selector *sel,
916 			 const struct flowi *fl, unsigned short family);
917 
918 #ifdef CONFIG_SECURITY_NETWORK_XFRM
919 /*	If neither has a context --> match
920  * 	Otherwise, both must have a context and the sids, doi, alg must match
921  */
xfrm_sec_ctx_match(struct xfrm_sec_ctx * s1,struct xfrm_sec_ctx * s2)922 static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
923 {
924 	return ((!s1 && !s2) ||
925 		(s1 && s2 &&
926 		 (s1->ctx_sid == s2->ctx_sid) &&
927 		 (s1->ctx_doi == s2->ctx_doi) &&
928 		 (s1->ctx_alg == s2->ctx_alg)));
929 }
930 #else
xfrm_sec_ctx_match(struct xfrm_sec_ctx * s1,struct xfrm_sec_ctx * s2)931 static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
932 {
933 	return true;
934 }
935 #endif
936 
937 /* A struct encoding bundle of transformations to apply to some set of flow.
938  *
939  * xdst->child points to the next element of bundle.
940  * dst->xfrm  points to an instanse of transformer.
941  *
942  * Due to unfortunate limitations of current routing cache, which we
943  * have no time to fix, it mirrors struct rtable and bound to the same
944  * routing key, including saddr,daddr. However, we can have many of
945  * bundles differing by session id. All the bundles grow from a parent
946  * policy rule.
947  */
948 struct xfrm_dst {
949 	union {
950 		struct dst_entry	dst;
951 		struct rtable		rt;
952 		struct rt6_info		rt6;
953 	} u;
954 	struct dst_entry *route;
955 	struct dst_entry *child;
956 	struct dst_entry *path;
957 	struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX];
958 	int num_pols, num_xfrms;
959 	u32 xfrm_genid;
960 	u32 policy_genid;
961 	u32 route_mtu_cached;
962 	u32 child_mtu_cached;
963 	u32 route_cookie;
964 	u32 path_cookie;
965 };
966 
xfrm_dst_path(const struct dst_entry * dst)967 static inline struct dst_entry *xfrm_dst_path(const struct dst_entry *dst)
968 {
969 #ifdef CONFIG_XFRM
970 	if (dst->xfrm || (dst->flags & DST_XFRM_QUEUE)) {
971 		const struct xfrm_dst *xdst = (const struct xfrm_dst *) dst;
972 
973 		return xdst->path;
974 	}
975 #endif
976 	return (struct dst_entry *) dst;
977 }
978 
xfrm_dst_child(const struct dst_entry * dst)979 static inline struct dst_entry *xfrm_dst_child(const struct dst_entry *dst)
980 {
981 #ifdef CONFIG_XFRM
982 	if (dst->xfrm || (dst->flags & DST_XFRM_QUEUE)) {
983 		struct xfrm_dst *xdst = (struct xfrm_dst *) dst;
984 		return xdst->child;
985 	}
986 #endif
987 	return NULL;
988 }
989 
990 #ifdef CONFIG_XFRM
xfrm_dst_set_child(struct xfrm_dst * xdst,struct dst_entry * child)991 static inline void xfrm_dst_set_child(struct xfrm_dst *xdst, struct dst_entry *child)
992 {
993 	xdst->child = child;
994 }
995 
xfrm_dst_destroy(struct xfrm_dst * xdst)996 static inline void xfrm_dst_destroy(struct xfrm_dst *xdst)
997 {
998 	xfrm_pols_put(xdst->pols, xdst->num_pols);
999 	dst_release(xdst->route);
1000 	if (likely(xdst->u.dst.xfrm))
1001 		xfrm_state_put(xdst->u.dst.xfrm);
1002 }
1003 #endif
1004 
1005 void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev);
1006 
1007 struct xfrm_if_parms {
1008 	int link;		/* ifindex of underlying L2 interface */
1009 	u32 if_id;		/* interface identifyer */
1010 	bool collect_md;
1011 };
1012 
1013 struct xfrm_if {
1014 	struct xfrm_if __rcu *next;	/* next interface in list */
1015 	struct net_device *dev;		/* virtual device associated with interface */
1016 	struct net *net;		/* netns for packet i/o */
1017 	struct xfrm_if_parms p;		/* interface parms */
1018 
1019 	struct gro_cells gro_cells;
1020 };
1021 
1022 struct xfrm_offload {
1023 	/* Output sequence number for replay protection on offloading. */
1024 	struct {
1025 		__u32 low;
1026 		__u32 hi;
1027 	} seq;
1028 
1029 	__u32			flags;
1030 #define	SA_DELETE_REQ		1
1031 #define	CRYPTO_DONE		2
1032 #define	CRYPTO_NEXT_DONE	4
1033 #define	CRYPTO_FALLBACK		8
1034 #define	XFRM_GSO_SEGMENT	16
1035 #define	XFRM_GRO		32
1036 /* 64 is free */
1037 #define	XFRM_DEV_RESUME		128
1038 #define	XFRM_XMIT		256
1039 
1040 	__u32			status;
1041 #define CRYPTO_SUCCESS				1
1042 #define CRYPTO_GENERIC_ERROR			2
1043 #define CRYPTO_TRANSPORT_AH_AUTH_FAILED		4
1044 #define CRYPTO_TRANSPORT_ESP_AUTH_FAILED	8
1045 #define CRYPTO_TUNNEL_AH_AUTH_FAILED		16
1046 #define CRYPTO_TUNNEL_ESP_AUTH_FAILED		32
1047 #define CRYPTO_INVALID_PACKET_SYNTAX		64
1048 #define CRYPTO_INVALID_PROTOCOL			128
1049 
1050 	__u8			proto;
1051 	__u8			inner_ipproto;
1052 };
1053 
1054 struct sec_path {
1055 	int			len;
1056 	int			olen;
1057 	int			verified_cnt;
1058 
1059 	struct xfrm_state	*xvec[XFRM_MAX_DEPTH];
1060 	struct xfrm_offload	ovec[XFRM_MAX_OFFLOAD_DEPTH];
1061 };
1062 
1063 struct sec_path *secpath_set(struct sk_buff *skb);
1064 
1065 static inline void
secpath_reset(struct sk_buff * skb)1066 secpath_reset(struct sk_buff *skb)
1067 {
1068 #ifdef CONFIG_XFRM
1069 	skb_ext_del(skb, SKB_EXT_SEC_PATH);
1070 #endif
1071 }
1072 
1073 static inline int
xfrm_addr_any(const xfrm_address_t * addr,unsigned short family)1074 xfrm_addr_any(const xfrm_address_t *addr, unsigned short family)
1075 {
1076 	switch (family) {
1077 	case AF_INET:
1078 		return addr->a4 == 0;
1079 	case AF_INET6:
1080 		return ipv6_addr_any(&addr->in6);
1081 	}
1082 	return 0;
1083 }
1084 
1085 static inline int
__xfrm4_state_addr_cmp(const struct xfrm_tmpl * tmpl,const struct xfrm_state * x)1086 __xfrm4_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x)
1087 {
1088 	return	(tmpl->saddr.a4 &&
1089 		 tmpl->saddr.a4 != x->props.saddr.a4);
1090 }
1091 
1092 static inline int
__xfrm6_state_addr_cmp(const struct xfrm_tmpl * tmpl,const struct xfrm_state * x)1093 __xfrm6_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x)
1094 {
1095 	return	(!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) &&
1096 		 !ipv6_addr_equal((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr));
1097 }
1098 
1099 static inline int
xfrm_state_addr_cmp(const struct xfrm_tmpl * tmpl,const struct xfrm_state * x,unsigned short family)1100 xfrm_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x, unsigned short family)
1101 {
1102 	switch (family) {
1103 	case AF_INET:
1104 		return __xfrm4_state_addr_cmp(tmpl, x);
1105 	case AF_INET6:
1106 		return __xfrm6_state_addr_cmp(tmpl, x);
1107 	}
1108 	return !0;
1109 }
1110 
1111 #ifdef CONFIG_XFRM
xfrm_input_state(struct sk_buff * skb)1112 static inline struct xfrm_state *xfrm_input_state(struct sk_buff *skb)
1113 {
1114 	struct sec_path *sp = skb_sec_path(skb);
1115 
1116 	return sp->xvec[sp->len - 1];
1117 }
1118 #endif
1119 
xfrm_offload(struct sk_buff * skb)1120 static inline struct xfrm_offload *xfrm_offload(struct sk_buff *skb)
1121 {
1122 #ifdef CONFIG_XFRM
1123 	struct sec_path *sp = skb_sec_path(skb);
1124 
1125 	if (!sp || !sp->olen || sp->len != sp->olen)
1126 		return NULL;
1127 
1128 	return &sp->ovec[sp->olen - 1];
1129 #else
1130 	return NULL;
1131 #endif
1132 }
1133 
1134 #ifdef CONFIG_XFRM
1135 int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb,
1136 			unsigned short family);
1137 
__xfrm_check_nopolicy(struct net * net,struct sk_buff * skb,int dir)1138 static inline bool __xfrm_check_nopolicy(struct net *net, struct sk_buff *skb,
1139 					 int dir)
1140 {
1141 	if (!net->xfrm.policy_count[dir] && !secpath_exists(skb))
1142 		return net->xfrm.policy_default[dir] == XFRM_USERPOLICY_ACCEPT;
1143 
1144 	return false;
1145 }
1146 
__xfrm_check_dev_nopolicy(struct sk_buff * skb,int dir,unsigned short family)1147 static inline bool __xfrm_check_dev_nopolicy(struct sk_buff *skb,
1148 					     int dir, unsigned short family)
1149 {
1150 	if (dir != XFRM_POLICY_OUT && family == AF_INET) {
1151 		/* same dst may be used for traffic originating from
1152 		 * devices with different policy settings.
1153 		 */
1154 		return IPCB(skb)->flags & IPSKB_NOPOLICY;
1155 	}
1156 	return skb_dst(skb) && (skb_dst(skb)->flags & DST_NOPOLICY);
1157 }
1158 
__xfrm_policy_check2(struct sock * sk,int dir,struct sk_buff * skb,unsigned int family,int reverse)1159 static inline int __xfrm_policy_check2(struct sock *sk, int dir,
1160 				       struct sk_buff *skb,
1161 				       unsigned int family, int reverse)
1162 {
1163 	struct net *net = dev_net(skb->dev);
1164 	int ndir = dir | (reverse ? XFRM_POLICY_MASK + 1 : 0);
1165 	struct xfrm_offload *xo = xfrm_offload(skb);
1166 	struct xfrm_state *x;
1167 
1168 	if (sk && sk->sk_policy[XFRM_POLICY_IN])
1169 		return __xfrm_policy_check(sk, ndir, skb, family);
1170 
1171 	if (xo) {
1172 		x = xfrm_input_state(skb);
1173 		if (x->xso.type == XFRM_DEV_OFFLOAD_PACKET)
1174 			return (xo->flags & CRYPTO_DONE) &&
1175 			       (xo->status & CRYPTO_SUCCESS);
1176 	}
1177 
1178 	return __xfrm_check_nopolicy(net, skb, dir) ||
1179 	       __xfrm_check_dev_nopolicy(skb, dir, family) ||
1180 	       __xfrm_policy_check(sk, ndir, skb, family);
1181 }
1182 
xfrm_policy_check(struct sock * sk,int dir,struct sk_buff * skb,unsigned short family)1183 static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
1184 {
1185 	return __xfrm_policy_check2(sk, dir, skb, family, 0);
1186 }
1187 
xfrm4_policy_check(struct sock * sk,int dir,struct sk_buff * skb)1188 static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1189 {
1190 	return xfrm_policy_check(sk, dir, skb, AF_INET);
1191 }
1192 
xfrm6_policy_check(struct sock * sk,int dir,struct sk_buff * skb)1193 static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1194 {
1195 	return xfrm_policy_check(sk, dir, skb, AF_INET6);
1196 }
1197 
xfrm4_policy_check_reverse(struct sock * sk,int dir,struct sk_buff * skb)1198 static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
1199 					     struct sk_buff *skb)
1200 {
1201 	return __xfrm_policy_check2(sk, dir, skb, AF_INET, 1);
1202 }
1203 
xfrm6_policy_check_reverse(struct sock * sk,int dir,struct sk_buff * skb)1204 static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
1205 					     struct sk_buff *skb)
1206 {
1207 	return __xfrm_policy_check2(sk, dir, skb, AF_INET6, 1);
1208 }
1209 
1210 int __xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
1211 			  unsigned int family, int reverse);
1212 
xfrm_decode_session(struct sk_buff * skb,struct flowi * fl,unsigned int family)1213 static inline int xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
1214 				      unsigned int family)
1215 {
1216 	return __xfrm_decode_session(skb, fl, family, 0);
1217 }
1218 
xfrm_decode_session_reverse(struct sk_buff * skb,struct flowi * fl,unsigned int family)1219 static inline int xfrm_decode_session_reverse(struct sk_buff *skb,
1220 					      struct flowi *fl,
1221 					      unsigned int family)
1222 {
1223 	return __xfrm_decode_session(skb, fl, family, 1);
1224 }
1225 
1226 int __xfrm_route_forward(struct sk_buff *skb, unsigned short family);
1227 
xfrm_route_forward(struct sk_buff * skb,unsigned short family)1228 static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family)
1229 {
1230 	struct net *net = dev_net(skb->dev);
1231 
1232 	if (!net->xfrm.policy_count[XFRM_POLICY_OUT] &&
1233 	    net->xfrm.policy_default[XFRM_POLICY_OUT] == XFRM_USERPOLICY_ACCEPT)
1234 		return true;
1235 
1236 	return (skb_dst(skb)->flags & DST_NOXFRM) ||
1237 	       __xfrm_route_forward(skb, family);
1238 }
1239 
xfrm4_route_forward(struct sk_buff * skb)1240 static inline int xfrm4_route_forward(struct sk_buff *skb)
1241 {
1242 	return xfrm_route_forward(skb, AF_INET);
1243 }
1244 
xfrm6_route_forward(struct sk_buff * skb)1245 static inline int xfrm6_route_forward(struct sk_buff *skb)
1246 {
1247 	return xfrm_route_forward(skb, AF_INET6);
1248 }
1249 
1250 int __xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk);
1251 
xfrm_sk_clone_policy(struct sock * sk,const struct sock * osk)1252 static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk)
1253 {
1254 	if (!sk_fullsock(osk))
1255 		return 0;
1256 	sk->sk_policy[0] = NULL;
1257 	sk->sk_policy[1] = NULL;
1258 	if (unlikely(osk->sk_policy[0] || osk->sk_policy[1]))
1259 		return __xfrm_sk_clone_policy(sk, osk);
1260 	return 0;
1261 }
1262 
1263 int xfrm_policy_delete(struct xfrm_policy *pol, int dir);
1264 
xfrm_sk_free_policy(struct sock * sk)1265 static inline void xfrm_sk_free_policy(struct sock *sk)
1266 {
1267 	struct xfrm_policy *pol;
1268 
1269 	pol = rcu_dereference_protected(sk->sk_policy[0], 1);
1270 	if (unlikely(pol != NULL)) {
1271 		xfrm_policy_delete(pol, XFRM_POLICY_MAX);
1272 		sk->sk_policy[0] = NULL;
1273 	}
1274 	pol = rcu_dereference_protected(sk->sk_policy[1], 1);
1275 	if (unlikely(pol != NULL)) {
1276 		xfrm_policy_delete(pol, XFRM_POLICY_MAX+1);
1277 		sk->sk_policy[1] = NULL;
1278 	}
1279 }
1280 
1281 #else
1282 
xfrm_sk_free_policy(struct sock * sk)1283 static inline void xfrm_sk_free_policy(struct sock *sk) {}
xfrm_sk_clone_policy(struct sock * sk,const struct sock * osk)1284 static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk) { return 0; }
xfrm6_route_forward(struct sk_buff * skb)1285 static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; }
xfrm4_route_forward(struct sk_buff * skb)1286 static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; }
xfrm6_policy_check(struct sock * sk,int dir,struct sk_buff * skb)1287 static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1288 {
1289 	return 1;
1290 }
xfrm4_policy_check(struct sock * sk,int dir,struct sk_buff * skb)1291 static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1292 {
1293 	return 1;
1294 }
xfrm_policy_check(struct sock * sk,int dir,struct sk_buff * skb,unsigned short family)1295 static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
1296 {
1297 	return 1;
1298 }
xfrm_decode_session_reverse(struct sk_buff * skb,struct flowi * fl,unsigned int family)1299 static inline int xfrm_decode_session_reverse(struct sk_buff *skb,
1300 					      struct flowi *fl,
1301 					      unsigned int family)
1302 {
1303 	return -ENOSYS;
1304 }
xfrm4_policy_check_reverse(struct sock * sk,int dir,struct sk_buff * skb)1305 static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
1306 					     struct sk_buff *skb)
1307 {
1308 	return 1;
1309 }
xfrm6_policy_check_reverse(struct sock * sk,int dir,struct sk_buff * skb)1310 static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
1311 					     struct sk_buff *skb)
1312 {
1313 	return 1;
1314 }
1315 #endif
1316 
1317 static __inline__
xfrm_flowi_daddr(const struct flowi * fl,unsigned short family)1318 xfrm_address_t *xfrm_flowi_daddr(const struct flowi *fl, unsigned short family)
1319 {
1320 	switch (family){
1321 	case AF_INET:
1322 		return (xfrm_address_t *)&fl->u.ip4.daddr;
1323 	case AF_INET6:
1324 		return (xfrm_address_t *)&fl->u.ip6.daddr;
1325 	}
1326 	return NULL;
1327 }
1328 
1329 static __inline__
xfrm_flowi_saddr(const struct flowi * fl,unsigned short family)1330 xfrm_address_t *xfrm_flowi_saddr(const struct flowi *fl, unsigned short family)
1331 {
1332 	switch (family){
1333 	case AF_INET:
1334 		return (xfrm_address_t *)&fl->u.ip4.saddr;
1335 	case AF_INET6:
1336 		return (xfrm_address_t *)&fl->u.ip6.saddr;
1337 	}
1338 	return NULL;
1339 }
1340 
1341 static __inline__
xfrm_flowi_addr_get(const struct flowi * fl,xfrm_address_t * saddr,xfrm_address_t * daddr,unsigned short family)1342 void xfrm_flowi_addr_get(const struct flowi *fl,
1343 			 xfrm_address_t *saddr, xfrm_address_t *daddr,
1344 			 unsigned short family)
1345 {
1346 	switch(family) {
1347 	case AF_INET:
1348 		memcpy(&saddr->a4, &fl->u.ip4.saddr, sizeof(saddr->a4));
1349 		memcpy(&daddr->a4, &fl->u.ip4.daddr, sizeof(daddr->a4));
1350 		break;
1351 	case AF_INET6:
1352 		saddr->in6 = fl->u.ip6.saddr;
1353 		daddr->in6 = fl->u.ip6.daddr;
1354 		break;
1355 	}
1356 }
1357 
1358 static __inline__ int
__xfrm4_state_addr_check(const struct xfrm_state * x,const xfrm_address_t * daddr,const xfrm_address_t * saddr)1359 __xfrm4_state_addr_check(const struct xfrm_state *x,
1360 			 const xfrm_address_t *daddr, const xfrm_address_t *saddr)
1361 {
1362 	if (daddr->a4 == x->id.daddr.a4 &&
1363 	    (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4))
1364 		return 1;
1365 	return 0;
1366 }
1367 
1368 static __inline__ int
__xfrm6_state_addr_check(const struct xfrm_state * x,const xfrm_address_t * daddr,const xfrm_address_t * saddr)1369 __xfrm6_state_addr_check(const struct xfrm_state *x,
1370 			 const xfrm_address_t *daddr, const xfrm_address_t *saddr)
1371 {
1372 	if (ipv6_addr_equal((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) &&
1373 	    (ipv6_addr_equal((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr) ||
1374 	     ipv6_addr_any((struct in6_addr *)saddr) ||
1375 	     ipv6_addr_any((struct in6_addr *)&x->props.saddr)))
1376 		return 1;
1377 	return 0;
1378 }
1379 
1380 static __inline__ int
xfrm_state_addr_check(const struct xfrm_state * x,const xfrm_address_t * daddr,const xfrm_address_t * saddr,unsigned short family)1381 xfrm_state_addr_check(const struct xfrm_state *x,
1382 		      const xfrm_address_t *daddr, const xfrm_address_t *saddr,
1383 		      unsigned short family)
1384 {
1385 	switch (family) {
1386 	case AF_INET:
1387 		return __xfrm4_state_addr_check(x, daddr, saddr);
1388 	case AF_INET6:
1389 		return __xfrm6_state_addr_check(x, daddr, saddr);
1390 	}
1391 	return 0;
1392 }
1393 
1394 static __inline__ int
xfrm_state_addr_flow_check(const struct xfrm_state * x,const struct flowi * fl,unsigned short family)1395 xfrm_state_addr_flow_check(const struct xfrm_state *x, const struct flowi *fl,
1396 			   unsigned short family)
1397 {
1398 	switch (family) {
1399 	case AF_INET:
1400 		return __xfrm4_state_addr_check(x,
1401 						(const xfrm_address_t *)&fl->u.ip4.daddr,
1402 						(const xfrm_address_t *)&fl->u.ip4.saddr);
1403 	case AF_INET6:
1404 		return __xfrm6_state_addr_check(x,
1405 						(const xfrm_address_t *)&fl->u.ip6.daddr,
1406 						(const xfrm_address_t *)&fl->u.ip6.saddr);
1407 	}
1408 	return 0;
1409 }
1410 
xfrm_state_kern(const struct xfrm_state * x)1411 static inline int xfrm_state_kern(const struct xfrm_state *x)
1412 {
1413 	return atomic_read(&x->tunnel_users);
1414 }
1415 
xfrm_id_proto_valid(u8 proto)1416 static inline bool xfrm_id_proto_valid(u8 proto)
1417 {
1418 	switch (proto) {
1419 	case IPPROTO_AH:
1420 	case IPPROTO_ESP:
1421 	case IPPROTO_COMP:
1422 #if IS_ENABLED(CONFIG_IPV6)
1423 	case IPPROTO_ROUTING:
1424 	case IPPROTO_DSTOPTS:
1425 #endif
1426 		return true;
1427 	default:
1428 		return false;
1429 	}
1430 }
1431 
1432 /* IPSEC_PROTO_ANY only matches 3 IPsec protocols, 0 could match all. */
xfrm_id_proto_match(u8 proto,u8 userproto)1433 static inline int xfrm_id_proto_match(u8 proto, u8 userproto)
1434 {
1435 	return (!userproto || proto == userproto ||
1436 		(userproto == IPSEC_PROTO_ANY && (proto == IPPROTO_AH ||
1437 						  proto == IPPROTO_ESP ||
1438 						  proto == IPPROTO_COMP)));
1439 }
1440 
1441 /*
1442  * xfrm algorithm information
1443  */
1444 struct xfrm_algo_aead_info {
1445 	char *geniv;
1446 	u16 icv_truncbits;
1447 };
1448 
1449 struct xfrm_algo_auth_info {
1450 	u16 icv_truncbits;
1451 	u16 icv_fullbits;
1452 };
1453 
1454 struct xfrm_algo_encr_info {
1455 	char *geniv;
1456 	u16 blockbits;
1457 	u16 defkeybits;
1458 };
1459 
1460 struct xfrm_algo_comp_info {
1461 	u16 threshold;
1462 };
1463 
1464 struct xfrm_algo_desc {
1465 	char *name;
1466 	char *compat;
1467 	u8 available:1;
1468 	u8 pfkey_supported:1;
1469 	union {
1470 		struct xfrm_algo_aead_info aead;
1471 		struct xfrm_algo_auth_info auth;
1472 		struct xfrm_algo_encr_info encr;
1473 		struct xfrm_algo_comp_info comp;
1474 	} uinfo;
1475 	struct sadb_alg desc;
1476 };
1477 
1478 /* XFRM protocol handlers.  */
1479 struct xfrm4_protocol {
1480 	int (*handler)(struct sk_buff *skb);
1481 	int (*input_handler)(struct sk_buff *skb, int nexthdr, __be32 spi,
1482 			     int encap_type);
1483 	int (*cb_handler)(struct sk_buff *skb, int err);
1484 	int (*err_handler)(struct sk_buff *skb, u32 info);
1485 
1486 	struct xfrm4_protocol __rcu *next;
1487 	int priority;
1488 };
1489 
1490 struct xfrm6_protocol {
1491 	int (*handler)(struct sk_buff *skb);
1492 	int (*input_handler)(struct sk_buff *skb, int nexthdr, __be32 spi,
1493 			     int encap_type);
1494 	int (*cb_handler)(struct sk_buff *skb, int err);
1495 	int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
1496 			   u8 type, u8 code, int offset, __be32 info);
1497 
1498 	struct xfrm6_protocol __rcu *next;
1499 	int priority;
1500 };
1501 
1502 /* XFRM tunnel handlers.  */
1503 struct xfrm_tunnel {
1504 	int (*handler)(struct sk_buff *skb);
1505 	int (*cb_handler)(struct sk_buff *skb, int err);
1506 	int (*err_handler)(struct sk_buff *skb, u32 info);
1507 
1508 	struct xfrm_tunnel __rcu *next;
1509 	int priority;
1510 };
1511 
1512 struct xfrm6_tunnel {
1513 	int (*handler)(struct sk_buff *skb);
1514 	int (*cb_handler)(struct sk_buff *skb, int err);
1515 	int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
1516 			   u8 type, u8 code, int offset, __be32 info);
1517 	struct xfrm6_tunnel __rcu *next;
1518 	int priority;
1519 };
1520 
1521 void xfrm_init(void);
1522 void xfrm4_init(void);
1523 int xfrm_state_init(struct net *net);
1524 void xfrm_state_fini(struct net *net);
1525 void xfrm4_state_init(void);
1526 void xfrm4_protocol_init(void);
1527 #ifdef CONFIG_XFRM
1528 int xfrm6_init(void);
1529 void xfrm6_fini(void);
1530 int xfrm6_state_init(void);
1531 void xfrm6_state_fini(void);
1532 int xfrm6_protocol_init(void);
1533 void xfrm6_protocol_fini(void);
1534 #else
xfrm6_init(void)1535 static inline int xfrm6_init(void)
1536 {
1537 	return 0;
1538 }
xfrm6_fini(void)1539 static inline void xfrm6_fini(void)
1540 {
1541 	;
1542 }
1543 #endif
1544 
1545 #ifdef CONFIG_XFRM_STATISTICS
1546 int xfrm_proc_init(struct net *net);
1547 void xfrm_proc_fini(struct net *net);
1548 #endif
1549 
1550 int xfrm_sysctl_init(struct net *net);
1551 #ifdef CONFIG_SYSCTL
1552 void xfrm_sysctl_fini(struct net *net);
1553 #else
xfrm_sysctl_fini(struct net * net)1554 static inline void xfrm_sysctl_fini(struct net *net)
1555 {
1556 }
1557 #endif
1558 
1559 void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto,
1560 			  struct xfrm_address_filter *filter);
1561 int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk,
1562 		    int (*func)(struct xfrm_state *, int, void*), void *);
1563 void xfrm_state_walk_done(struct xfrm_state_walk *walk, struct net *net);
1564 struct xfrm_state *xfrm_state_alloc(struct net *net);
1565 void xfrm_state_free(struct xfrm_state *x);
1566 struct xfrm_state *xfrm_state_find(const xfrm_address_t *daddr,
1567 				   const xfrm_address_t *saddr,
1568 				   const struct flowi *fl,
1569 				   struct xfrm_tmpl *tmpl,
1570 				   struct xfrm_policy *pol, int *err,
1571 				   unsigned short family, u32 if_id);
1572 struct xfrm_state *xfrm_stateonly_find(struct net *net, u32 mark, u32 if_id,
1573 				       xfrm_address_t *daddr,
1574 				       xfrm_address_t *saddr,
1575 				       unsigned short family,
1576 				       u8 mode, u8 proto, u32 reqid);
1577 struct xfrm_state *xfrm_state_lookup_byspi(struct net *net, __be32 spi,
1578 					      unsigned short family);
1579 int xfrm_state_check_expire(struct xfrm_state *x);
1580 #ifdef CONFIG_XFRM_OFFLOAD
xfrm_dev_state_update_curlft(struct xfrm_state * x)1581 static inline void xfrm_dev_state_update_curlft(struct xfrm_state *x)
1582 {
1583 	struct xfrm_dev_offload *xdo = &x->xso;
1584 	struct net_device *dev = xdo->dev;
1585 
1586 	if (x->xso.type != XFRM_DEV_OFFLOAD_PACKET)
1587 		return;
1588 
1589 	if (dev && dev->xfrmdev_ops &&
1590 	    dev->xfrmdev_ops->xdo_dev_state_update_curlft)
1591 		dev->xfrmdev_ops->xdo_dev_state_update_curlft(x);
1592 
1593 }
1594 #else
xfrm_dev_state_update_curlft(struct xfrm_state * x)1595 static inline void xfrm_dev_state_update_curlft(struct xfrm_state *x) {}
1596 #endif
1597 void xfrm_state_insert(struct xfrm_state *x);
1598 int xfrm_state_add(struct xfrm_state *x);
1599 int xfrm_state_update(struct xfrm_state *x);
1600 struct xfrm_state *xfrm_state_lookup(struct net *net, u32 mark,
1601 				     const xfrm_address_t *daddr, __be32 spi,
1602 				     u8 proto, unsigned short family);
1603 struct xfrm_state *xfrm_state_lookup_byaddr(struct net *net, u32 mark,
1604 					    const xfrm_address_t *daddr,
1605 					    const xfrm_address_t *saddr,
1606 					    u8 proto,
1607 					    unsigned short family);
1608 #ifdef CONFIG_XFRM_SUB_POLICY
1609 void xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n,
1610 		    unsigned short family);
1611 void xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n,
1612 		     unsigned short family);
1613 #else
xfrm_tmpl_sort(struct xfrm_tmpl ** d,struct xfrm_tmpl ** s,int n,unsigned short family)1614 static inline void xfrm_tmpl_sort(struct xfrm_tmpl **d, struct xfrm_tmpl **s,
1615 				  int n, unsigned short family)
1616 {
1617 }
1618 
xfrm_state_sort(struct xfrm_state ** d,struct xfrm_state ** s,int n,unsigned short family)1619 static inline void xfrm_state_sort(struct xfrm_state **d, struct xfrm_state **s,
1620 				   int n, unsigned short family)
1621 {
1622 }
1623 #endif
1624 
1625 struct xfrmk_sadinfo {
1626 	u32 sadhcnt; /* current hash bkts */
1627 	u32 sadhmcnt; /* max allowed hash bkts */
1628 	u32 sadcnt; /* current running count */
1629 };
1630 
1631 struct xfrmk_spdinfo {
1632 	u32 incnt;
1633 	u32 outcnt;
1634 	u32 fwdcnt;
1635 	u32 inscnt;
1636 	u32 outscnt;
1637 	u32 fwdscnt;
1638 	u32 spdhcnt;
1639 	u32 spdhmcnt;
1640 };
1641 
1642 struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq);
1643 int xfrm_state_delete(struct xfrm_state *x);
1644 int xfrm_state_flush(struct net *net, u8 proto, bool task_valid, bool sync);
1645 int xfrm_dev_state_flush(struct net *net, struct net_device *dev, bool task_valid);
1646 int xfrm_dev_policy_flush(struct net *net, struct net_device *dev,
1647 			  bool task_valid);
1648 void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si);
1649 void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si);
1650 u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq);
1651 int xfrm_init_replay(struct xfrm_state *x, struct netlink_ext_ack *extack);
1652 u32 xfrm_state_mtu(struct xfrm_state *x, int mtu);
1653 int __xfrm_init_state(struct xfrm_state *x, bool init_replay, bool offload,
1654 		      struct netlink_ext_ack *extack);
1655 int xfrm_init_state(struct xfrm_state *x);
1656 int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type);
1657 int xfrm_input_resume(struct sk_buff *skb, int nexthdr);
1658 int xfrm_trans_queue_net(struct net *net, struct sk_buff *skb,
1659 			 int (*finish)(struct net *, struct sock *,
1660 				       struct sk_buff *));
1661 int xfrm_trans_queue(struct sk_buff *skb,
1662 		     int (*finish)(struct net *, struct sock *,
1663 				   struct sk_buff *));
1664 int xfrm_output_resume(struct sock *sk, struct sk_buff *skb, int err);
1665 int xfrm_output(struct sock *sk, struct sk_buff *skb);
1666 
1667 #if IS_ENABLED(CONFIG_NET_PKTGEN)
1668 int pktgen_xfrm_outer_mode_output(struct xfrm_state *x, struct sk_buff *skb);
1669 #endif
1670 
1671 void xfrm_local_error(struct sk_buff *skb, int mtu);
1672 int xfrm4_extract_input(struct xfrm_state *x, struct sk_buff *skb);
1673 int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi,
1674 		    int encap_type);
1675 int xfrm4_transport_finish(struct sk_buff *skb, int async);
1676 int xfrm4_rcv(struct sk_buff *skb);
1677 
xfrm4_rcv_spi(struct sk_buff * skb,int nexthdr,__be32 spi)1678 static inline int xfrm4_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi)
1679 {
1680 	XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL;
1681 	XFRM_SPI_SKB_CB(skb)->family = AF_INET;
1682 	XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr);
1683 	return xfrm_input(skb, nexthdr, spi, 0);
1684 }
1685 
1686 int xfrm4_output(struct net *net, struct sock *sk, struct sk_buff *skb);
1687 int xfrm4_protocol_register(struct xfrm4_protocol *handler, unsigned char protocol);
1688 int xfrm4_protocol_deregister(struct xfrm4_protocol *handler, unsigned char protocol);
1689 int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family);
1690 int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family);
1691 void xfrm4_local_error(struct sk_buff *skb, u32 mtu);
1692 int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb);
1693 int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi,
1694 		  struct ip6_tnl *t);
1695 int xfrm6_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi,
1696 		    int encap_type);
1697 int xfrm6_transport_finish(struct sk_buff *skb, int async);
1698 int xfrm6_rcv_tnl(struct sk_buff *skb, struct ip6_tnl *t);
1699 int xfrm6_rcv(struct sk_buff *skb);
1700 int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
1701 		     xfrm_address_t *saddr, u8 proto);
1702 void xfrm6_local_error(struct sk_buff *skb, u32 mtu);
1703 int xfrm6_protocol_register(struct xfrm6_protocol *handler, unsigned char protocol);
1704 int xfrm6_protocol_deregister(struct xfrm6_protocol *handler, unsigned char protocol);
1705 int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family);
1706 int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family);
1707 __be32 xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr);
1708 __be32 xfrm6_tunnel_spi_lookup(struct net *net, const xfrm_address_t *saddr);
1709 int xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb);
1710 
1711 #ifdef CONFIG_XFRM
1712 void xfrm6_local_rxpmtu(struct sk_buff *skb, u32 mtu);
1713 int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb);
1714 int xfrm6_udp_encap_rcv(struct sock *sk, struct sk_buff *skb);
1715 int xfrm_user_policy(struct sock *sk, int optname, sockptr_t optval,
1716 		     int optlen);
1717 #else
xfrm_user_policy(struct sock * sk,int optname,sockptr_t optval,int optlen)1718 static inline int xfrm_user_policy(struct sock *sk, int optname,
1719 				   sockptr_t optval, int optlen)
1720 {
1721  	return -ENOPROTOOPT;
1722 }
1723 #endif
1724 
1725 struct dst_entry *__xfrm_dst_lookup(struct net *net, int tos, int oif,
1726 				    const xfrm_address_t *saddr,
1727 				    const xfrm_address_t *daddr,
1728 				    int family, u32 mark);
1729 
1730 struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp);
1731 
1732 void xfrm_policy_walk_init(struct xfrm_policy_walk *walk, u8 type);
1733 int xfrm_policy_walk(struct net *net, struct xfrm_policy_walk *walk,
1734 		     int (*func)(struct xfrm_policy *, int, int, void*),
1735 		     void *);
1736 void xfrm_policy_walk_done(struct xfrm_policy_walk *walk, struct net *net);
1737 int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl);
1738 struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net,
1739 					  const struct xfrm_mark *mark,
1740 					  u32 if_id, u8 type, int dir,
1741 					  struct xfrm_selector *sel,
1742 					  struct xfrm_sec_ctx *ctx, int delete,
1743 					  int *err);
1744 struct xfrm_policy *xfrm_policy_byid(struct net *net,
1745 				     const struct xfrm_mark *mark, u32 if_id,
1746 				     u8 type, int dir, u32 id, int delete,
1747 				     int *err);
1748 int xfrm_policy_flush(struct net *net, u8 type, bool task_valid);
1749 void xfrm_policy_hash_rebuild(struct net *net);
1750 u32 xfrm_get_acqseq(void);
1751 int verify_spi_info(u8 proto, u32 min, u32 max, struct netlink_ext_ack *extack);
1752 int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi,
1753 		   struct netlink_ext_ack *extack);
1754 struct xfrm_state *xfrm_find_acq(struct net *net, const struct xfrm_mark *mark,
1755 				 u8 mode, u32 reqid, u32 if_id, u8 proto,
1756 				 const xfrm_address_t *daddr,
1757 				 const xfrm_address_t *saddr, int create,
1758 				 unsigned short family);
1759 int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol);
1760 
1761 #ifdef CONFIG_XFRM_MIGRATE
1762 int km_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
1763 	       const struct xfrm_migrate *m, int num_bundles,
1764 	       const struct xfrm_kmaddress *k,
1765 	       const struct xfrm_encap_tmpl *encap);
1766 struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net,
1767 						u32 if_id);
1768 struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x,
1769 				      struct xfrm_migrate *m,
1770 				      struct xfrm_encap_tmpl *encap);
1771 int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
1772 		 struct xfrm_migrate *m, int num_bundles,
1773 		 struct xfrm_kmaddress *k, struct net *net,
1774 		 struct xfrm_encap_tmpl *encap, u32 if_id,
1775 		 struct netlink_ext_ack *extack);
1776 #endif
1777 
1778 int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
1779 void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 portid);
1780 int km_report(struct net *net, u8 proto, struct xfrm_selector *sel,
1781 	      xfrm_address_t *addr);
1782 
1783 void xfrm_input_init(void);
1784 int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq);
1785 
1786 void xfrm_probe_algs(void);
1787 int xfrm_count_pfkey_auth_supported(void);
1788 int xfrm_count_pfkey_enc_supported(void);
1789 struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx);
1790 struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx);
1791 struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id);
1792 struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id);
1793 struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id);
1794 struct xfrm_algo_desc *xfrm_aalg_get_byname(const char *name, int probe);
1795 struct xfrm_algo_desc *xfrm_ealg_get_byname(const char *name, int probe);
1796 struct xfrm_algo_desc *xfrm_calg_get_byname(const char *name, int probe);
1797 struct xfrm_algo_desc *xfrm_aead_get_byname(const char *name, int icv_len,
1798 					    int probe);
1799 
xfrm6_addr_equal(const xfrm_address_t * a,const xfrm_address_t * b)1800 static inline bool xfrm6_addr_equal(const xfrm_address_t *a,
1801 				    const xfrm_address_t *b)
1802 {
1803 	return ipv6_addr_equal((const struct in6_addr *)a,
1804 			       (const struct in6_addr *)b);
1805 }
1806 
xfrm_addr_equal(const xfrm_address_t * a,const xfrm_address_t * b,sa_family_t family)1807 static inline bool xfrm_addr_equal(const xfrm_address_t *a,
1808 				   const xfrm_address_t *b,
1809 				   sa_family_t family)
1810 {
1811 	switch (family) {
1812 	default:
1813 	case AF_INET:
1814 		return ((__force u32)a->a4 ^ (__force u32)b->a4) == 0;
1815 	case AF_INET6:
1816 		return xfrm6_addr_equal(a, b);
1817 	}
1818 }
1819 
xfrm_policy_id2dir(u32 index)1820 static inline int xfrm_policy_id2dir(u32 index)
1821 {
1822 	return index & 7;
1823 }
1824 
1825 #ifdef CONFIG_XFRM
1826 void xfrm_replay_advance(struct xfrm_state *x, __be32 net_seq);
1827 int xfrm_replay_check(struct xfrm_state *x, struct sk_buff *skb, __be32 net_seq);
1828 void xfrm_replay_notify(struct xfrm_state *x, int event);
1829 int xfrm_replay_overflow(struct xfrm_state *x, struct sk_buff *skb);
1830 int xfrm_replay_recheck(struct xfrm_state *x, struct sk_buff *skb, __be32 net_seq);
1831 
xfrm_aevent_is_on(struct net * net)1832 static inline int xfrm_aevent_is_on(struct net *net)
1833 {
1834 	struct sock *nlsk;
1835 	int ret = 0;
1836 
1837 	rcu_read_lock();
1838 	nlsk = rcu_dereference(net->xfrm.nlsk);
1839 	if (nlsk)
1840 		ret = netlink_has_listeners(nlsk, XFRMNLGRP_AEVENTS);
1841 	rcu_read_unlock();
1842 	return ret;
1843 }
1844 
xfrm_acquire_is_on(struct net * net)1845 static inline int xfrm_acquire_is_on(struct net *net)
1846 {
1847 	struct sock *nlsk;
1848 	int ret = 0;
1849 
1850 	rcu_read_lock();
1851 	nlsk = rcu_dereference(net->xfrm.nlsk);
1852 	if (nlsk)
1853 		ret = netlink_has_listeners(nlsk, XFRMNLGRP_ACQUIRE);
1854 	rcu_read_unlock();
1855 
1856 	return ret;
1857 }
1858 #endif
1859 
aead_len(struct xfrm_algo_aead * alg)1860 static inline unsigned int aead_len(struct xfrm_algo_aead *alg)
1861 {
1862 	return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1863 }
1864 
xfrm_alg_len(const struct xfrm_algo * alg)1865 static inline unsigned int xfrm_alg_len(const struct xfrm_algo *alg)
1866 {
1867 	return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1868 }
1869 
xfrm_alg_auth_len(const struct xfrm_algo_auth * alg)1870 static inline unsigned int xfrm_alg_auth_len(const struct xfrm_algo_auth *alg)
1871 {
1872 	return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1873 }
1874 
xfrm_replay_state_esn_len(struct xfrm_replay_state_esn * replay_esn)1875 static inline unsigned int xfrm_replay_state_esn_len(struct xfrm_replay_state_esn *replay_esn)
1876 {
1877 	return sizeof(*replay_esn) + replay_esn->bmp_len * sizeof(__u32);
1878 }
1879 
1880 #ifdef CONFIG_XFRM_MIGRATE
xfrm_replay_clone(struct xfrm_state * x,struct xfrm_state * orig)1881 static inline int xfrm_replay_clone(struct xfrm_state *x,
1882 				     struct xfrm_state *orig)
1883 {
1884 
1885 	x->replay_esn = kmemdup(orig->replay_esn,
1886 				xfrm_replay_state_esn_len(orig->replay_esn),
1887 				GFP_KERNEL);
1888 	if (!x->replay_esn)
1889 		return -ENOMEM;
1890 	x->preplay_esn = kmemdup(orig->preplay_esn,
1891 				 xfrm_replay_state_esn_len(orig->preplay_esn),
1892 				 GFP_KERNEL);
1893 	if (!x->preplay_esn)
1894 		return -ENOMEM;
1895 
1896 	return 0;
1897 }
1898 
xfrm_algo_aead_clone(struct xfrm_algo_aead * orig)1899 static inline struct xfrm_algo_aead *xfrm_algo_aead_clone(struct xfrm_algo_aead *orig)
1900 {
1901 	return kmemdup(orig, aead_len(orig), GFP_KERNEL);
1902 }
1903 
1904 
xfrm_algo_clone(struct xfrm_algo * orig)1905 static inline struct xfrm_algo *xfrm_algo_clone(struct xfrm_algo *orig)
1906 {
1907 	return kmemdup(orig, xfrm_alg_len(orig), GFP_KERNEL);
1908 }
1909 
xfrm_algo_auth_clone(struct xfrm_algo_auth * orig)1910 static inline struct xfrm_algo_auth *xfrm_algo_auth_clone(struct xfrm_algo_auth *orig)
1911 {
1912 	return kmemdup(orig, xfrm_alg_auth_len(orig), GFP_KERNEL);
1913 }
1914 
xfrm_states_put(struct xfrm_state ** states,int n)1915 static inline void xfrm_states_put(struct xfrm_state **states, int n)
1916 {
1917 	int i;
1918 	for (i = 0; i < n; i++)
1919 		xfrm_state_put(*(states + i));
1920 }
1921 
xfrm_states_delete(struct xfrm_state ** states,int n)1922 static inline void xfrm_states_delete(struct xfrm_state **states, int n)
1923 {
1924 	int i;
1925 	for (i = 0; i < n; i++)
1926 		xfrm_state_delete(*(states + i));
1927 }
1928 #endif
1929 
1930 void __init xfrm_dev_init(void);
1931 
1932 #ifdef CONFIG_XFRM_OFFLOAD
1933 void xfrm_dev_resume(struct sk_buff *skb);
1934 void xfrm_dev_backlog(struct softnet_data *sd);
1935 struct sk_buff *validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t features, bool *again);
1936 int xfrm_dev_state_add(struct net *net, struct xfrm_state *x,
1937 		       struct xfrm_user_offload *xuo,
1938 		       struct netlink_ext_ack *extack);
1939 int xfrm_dev_policy_add(struct net *net, struct xfrm_policy *xp,
1940 			struct xfrm_user_offload *xuo, u8 dir,
1941 			struct netlink_ext_ack *extack);
1942 bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x);
1943 
xfrm_dev_state_advance_esn(struct xfrm_state * x)1944 static inline void xfrm_dev_state_advance_esn(struct xfrm_state *x)
1945 {
1946 	struct xfrm_dev_offload *xso = &x->xso;
1947 
1948 	if (xso->dev && xso->dev->xfrmdev_ops->xdo_dev_state_advance_esn)
1949 		xso->dev->xfrmdev_ops->xdo_dev_state_advance_esn(x);
1950 }
1951 
xfrm_dst_offload_ok(struct dst_entry * dst)1952 static inline bool xfrm_dst_offload_ok(struct dst_entry *dst)
1953 {
1954 	struct xfrm_state *x = dst->xfrm;
1955 	struct xfrm_dst *xdst;
1956 
1957 	if (!x || !x->type_offload)
1958 		return false;
1959 
1960 	xdst = (struct xfrm_dst *) dst;
1961 	if (!x->xso.offload_handle && !xdst->child->xfrm)
1962 		return true;
1963 	if (x->xso.offload_handle && (x->xso.dev == xfrm_dst_path(dst)->dev) &&
1964 	    !xdst->child->xfrm)
1965 		return true;
1966 
1967 	return false;
1968 }
1969 
xfrm_dev_state_delete(struct xfrm_state * x)1970 static inline void xfrm_dev_state_delete(struct xfrm_state *x)
1971 {
1972 	struct xfrm_dev_offload *xso = &x->xso;
1973 
1974 	if (xso->dev)
1975 		xso->dev->xfrmdev_ops->xdo_dev_state_delete(x);
1976 }
1977 
xfrm_dev_state_free(struct xfrm_state * x)1978 static inline void xfrm_dev_state_free(struct xfrm_state *x)
1979 {
1980 	struct xfrm_dev_offload *xso = &x->xso;
1981 	struct net_device *dev = xso->dev;
1982 
1983 	if (dev && dev->xfrmdev_ops) {
1984 		if (dev->xfrmdev_ops->xdo_dev_state_free)
1985 			dev->xfrmdev_ops->xdo_dev_state_free(x);
1986 		xso->dev = NULL;
1987 		xso->type = XFRM_DEV_OFFLOAD_UNSPECIFIED;
1988 		netdev_put(dev, &xso->dev_tracker);
1989 	}
1990 }
1991 
xfrm_dev_policy_delete(struct xfrm_policy * x)1992 static inline void xfrm_dev_policy_delete(struct xfrm_policy *x)
1993 {
1994 	struct xfrm_dev_offload *xdo = &x->xdo;
1995 	struct net_device *dev = xdo->dev;
1996 
1997 	if (dev && dev->xfrmdev_ops && dev->xfrmdev_ops->xdo_dev_policy_delete)
1998 		dev->xfrmdev_ops->xdo_dev_policy_delete(x);
1999 }
2000 
xfrm_dev_policy_free(struct xfrm_policy * x)2001 static inline void xfrm_dev_policy_free(struct xfrm_policy *x)
2002 {
2003 	struct xfrm_dev_offload *xdo = &x->xdo;
2004 	struct net_device *dev = xdo->dev;
2005 
2006 	if (dev && dev->xfrmdev_ops) {
2007 		if (dev->xfrmdev_ops->xdo_dev_policy_free)
2008 			dev->xfrmdev_ops->xdo_dev_policy_free(x);
2009 		xdo->dev = NULL;
2010 		netdev_put(dev, &xdo->dev_tracker);
2011 	}
2012 }
2013 #else
xfrm_dev_resume(struct sk_buff * skb)2014 static inline void xfrm_dev_resume(struct sk_buff *skb)
2015 {
2016 }
2017 
xfrm_dev_backlog(struct softnet_data * sd)2018 static inline void xfrm_dev_backlog(struct softnet_data *sd)
2019 {
2020 }
2021 
validate_xmit_xfrm(struct sk_buff * skb,netdev_features_t features,bool * again)2022 static inline struct sk_buff *validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t features, bool *again)
2023 {
2024 	return skb;
2025 }
2026 
xfrm_dev_state_add(struct net * net,struct xfrm_state * x,struct xfrm_user_offload * xuo,struct netlink_ext_ack * extack)2027 static inline int xfrm_dev_state_add(struct net *net, struct xfrm_state *x, struct xfrm_user_offload *xuo, struct netlink_ext_ack *extack)
2028 {
2029 	return 0;
2030 }
2031 
xfrm_dev_state_delete(struct xfrm_state * x)2032 static inline void xfrm_dev_state_delete(struct xfrm_state *x)
2033 {
2034 }
2035 
xfrm_dev_state_free(struct xfrm_state * x)2036 static inline void xfrm_dev_state_free(struct xfrm_state *x)
2037 {
2038 }
2039 
xfrm_dev_policy_add(struct net * net,struct xfrm_policy * xp,struct xfrm_user_offload * xuo,u8 dir,struct netlink_ext_ack * extack)2040 static inline int xfrm_dev_policy_add(struct net *net, struct xfrm_policy *xp,
2041 				      struct xfrm_user_offload *xuo, u8 dir,
2042 				      struct netlink_ext_ack *extack)
2043 {
2044 	return 0;
2045 }
2046 
xfrm_dev_policy_delete(struct xfrm_policy * x)2047 static inline void xfrm_dev_policy_delete(struct xfrm_policy *x)
2048 {
2049 }
2050 
xfrm_dev_policy_free(struct xfrm_policy * x)2051 static inline void xfrm_dev_policy_free(struct xfrm_policy *x)
2052 {
2053 }
2054 
xfrm_dev_offload_ok(struct sk_buff * skb,struct xfrm_state * x)2055 static inline bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x)
2056 {
2057 	return false;
2058 }
2059 
xfrm_dev_state_advance_esn(struct xfrm_state * x)2060 static inline void xfrm_dev_state_advance_esn(struct xfrm_state *x)
2061 {
2062 }
2063 
xfrm_dst_offload_ok(struct dst_entry * dst)2064 static inline bool xfrm_dst_offload_ok(struct dst_entry *dst)
2065 {
2066 	return false;
2067 }
2068 #endif
2069 
xfrm_mark_get(struct nlattr ** attrs,struct xfrm_mark * m)2070 static inline int xfrm_mark_get(struct nlattr **attrs, struct xfrm_mark *m)
2071 {
2072 	if (attrs[XFRMA_MARK])
2073 		memcpy(m, nla_data(attrs[XFRMA_MARK]), sizeof(struct xfrm_mark));
2074 	else
2075 		m->v = m->m = 0;
2076 
2077 	return m->v & m->m;
2078 }
2079 
xfrm_mark_put(struct sk_buff * skb,const struct xfrm_mark * m)2080 static inline int xfrm_mark_put(struct sk_buff *skb, const struct xfrm_mark *m)
2081 {
2082 	int ret = 0;
2083 
2084 	if (m->m | m->v)
2085 		ret = nla_put(skb, XFRMA_MARK, sizeof(struct xfrm_mark), m);
2086 	return ret;
2087 }
2088 
xfrm_smark_get(__u32 mark,struct xfrm_state * x)2089 static inline __u32 xfrm_smark_get(__u32 mark, struct xfrm_state *x)
2090 {
2091 	struct xfrm_mark *m = &x->props.smark;
2092 
2093 	return (m->v & m->m) | (mark & ~m->m);
2094 }
2095 
xfrm_if_id_put(struct sk_buff * skb,__u32 if_id)2096 static inline int xfrm_if_id_put(struct sk_buff *skb, __u32 if_id)
2097 {
2098 	int ret = 0;
2099 
2100 	if (if_id)
2101 		ret = nla_put_u32(skb, XFRMA_IF_ID, if_id);
2102 	return ret;
2103 }
2104 
xfrm_tunnel_check(struct sk_buff * skb,struct xfrm_state * x,unsigned int family)2105 static inline int xfrm_tunnel_check(struct sk_buff *skb, struct xfrm_state *x,
2106 				    unsigned int family)
2107 {
2108 	bool tunnel = false;
2109 
2110 	switch(family) {
2111 	case AF_INET:
2112 		if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4)
2113 			tunnel = true;
2114 		break;
2115 	case AF_INET6:
2116 		if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6)
2117 			tunnel = true;
2118 		break;
2119 	}
2120 	if (tunnel && !(x->outer_mode.flags & XFRM_MODE_FLAG_TUNNEL))
2121 		return -EINVAL;
2122 
2123 	return 0;
2124 }
2125 
2126 extern const int xfrm_msg_min[XFRM_NR_MSGTYPES];
2127 extern const struct nla_policy xfrma_policy[XFRMA_MAX+1];
2128 
2129 struct xfrm_translator {
2130 	/* Allocate frag_list and put compat translation there */
2131 	int (*alloc_compat)(struct sk_buff *skb, const struct nlmsghdr *src);
2132 
2133 	/* Allocate nlmsg with 64-bit translaton of received 32-bit message */
2134 	struct nlmsghdr *(*rcv_msg_compat)(const struct nlmsghdr *nlh,
2135 			int maxtype, const struct nla_policy *policy,
2136 			struct netlink_ext_ack *extack);
2137 
2138 	/* Translate 32-bit user_policy from sockptr */
2139 	int (*xlate_user_policy_sockptr)(u8 **pdata32, int optlen);
2140 
2141 	struct module *owner;
2142 };
2143 
2144 #if IS_ENABLED(CONFIG_XFRM_USER_COMPAT)
2145 extern int xfrm_register_translator(struct xfrm_translator *xtr);
2146 extern int xfrm_unregister_translator(struct xfrm_translator *xtr);
2147 extern struct xfrm_translator *xfrm_get_translator(void);
2148 extern void xfrm_put_translator(struct xfrm_translator *xtr);
2149 #else
xfrm_get_translator(void)2150 static inline struct xfrm_translator *xfrm_get_translator(void)
2151 {
2152 	return NULL;
2153 }
xfrm_put_translator(struct xfrm_translator * xtr)2154 static inline void xfrm_put_translator(struct xfrm_translator *xtr)
2155 {
2156 }
2157 #endif
2158 
2159 #if IS_ENABLED(CONFIG_IPV6)
xfrm6_local_dontfrag(const struct sock * sk)2160 static inline bool xfrm6_local_dontfrag(const struct sock *sk)
2161 {
2162 	int proto;
2163 
2164 	if (!sk || sk->sk_family != AF_INET6)
2165 		return false;
2166 
2167 	proto = sk->sk_protocol;
2168 	if (proto == IPPROTO_UDP || proto == IPPROTO_RAW)
2169 		return inet6_sk(sk)->dontfrag;
2170 
2171 	return false;
2172 }
2173 #endif
2174 
2175 #if (IS_BUILTIN(CONFIG_XFRM_INTERFACE) && IS_ENABLED(CONFIG_DEBUG_INFO_BTF)) || \
2176     (IS_MODULE(CONFIG_XFRM_INTERFACE) && IS_ENABLED(CONFIG_DEBUG_INFO_BTF_MODULES))
2177 
2178 extern struct metadata_dst __percpu *xfrm_bpf_md_dst;
2179 
2180 int register_xfrm_interface_bpf(void);
2181 
2182 #else
2183 
register_xfrm_interface_bpf(void)2184 static inline int register_xfrm_interface_bpf(void)
2185 {
2186 	return 0;
2187 }
2188 
2189 #endif
2190 
2191 #endif	/* _NET_XFRM_H */
2192