Merge branch 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik...

[pandora-kernel.git] / include / net / xfrm.h

diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index a5f80bf..77be396 100644 (file)
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -2,7 +2,6 @@
 #define _NET_XFRM_H
 
 #include <linux/compiler.h>
-#include <linux/in.h>
 #include <linux/xfrm.h>
 #include <linux/spinlock.h>
 #include <linux/list.h>
@@ -12,9 +11,11 @@
 #include <linux/ipsec.h>
 #include <linux/in6.h>
 #include <linux/mutex.h>
+#include <linux/audit.h>
 
 #include <net/sock.h>
 #include <net/dst.h>
+#include <net/ip.h>
 #include <net/route.h>
 #include <net/ipv6.h>
 #include <net/ip6_fib.h>
@@ -278,6 +279,7 @@ struct xfrm_type
        __u8                    proto;
        __u8                    flags;
 #define XFRM_TYPE_NON_FRAGMENT 1
+#define XFRM_TYPE_REPLAY_PROT  2
 
        int                     (*init_state)(struct xfrm_state *x);
        void                    (*destructor)(struct xfrm_state *);
@@ -298,6 +300,18 @@ extern void xfrm_put_type(struct xfrm_type *type);
 
 struct xfrm_mode {
        int (*input)(struct xfrm_state *x, struct sk_buff *skb);
+
+       /*
+        * Add encapsulation header.
+        *
+        * On exit, the transport header will be set to the start of the
+        * encapsulation header to be filled in by x->type->output and
+        * the mac header will be set to the nextheader (protocol for
+        * IPv4) field of the extension header directly preceding the
+        * encapsulation header, or in its absence, that of the top IP
+        * header.  The value of the network header will always point
+        * to the top IP header while skb->data will point to the payload.
+        */
        int (*output)(struct xfrm_state *x,struct sk_buff *skb);
 
        struct module *owner;
@@ -418,18 +432,66 @@ extern int xfrm_unregister_km(struct xfrm_mgr *km);
 
 extern unsigned int xfrm_policy_count[XFRM_POLICY_MAX*2];
 
+/*
+ * This structure is used for the duration where packets are being
+ * transformed by IPsec.  As soon as the packet leaves IPsec the
+ * area beyond the generic IP part may be overwritten.
+ */
+struct xfrm_skb_cb {
+       union {
+               struct inet_skb_parm h4;
+               struct inet6_skb_parm h6;
+        } header;
+
+        /* Sequence number for replay protection. */
+        u64 seq;
+};
+
+#define XFRM_SKB_CB(__skb) ((struct xfrm_skb_cb *)&((__skb)->cb[0]))
+
 /* Audit Information */
 struct xfrm_audit
 {
-       uid_t   loginuid;
+       u32     loginuid;
        u32     secid;
 };
 
 #ifdef CONFIG_AUDITSYSCALL
-extern void xfrm_audit_log(uid_t auid, u32 secid, int type, int result,
-                   struct xfrm_policy *xp, struct xfrm_state *x);
+static inline struct audit_buffer *xfrm_audit_start(u32 auid, u32 sid)
+{
+       struct audit_buffer *audit_buf = NULL;
+       char *secctx;
+       u32 secctx_len;
+
+       audit_buf = audit_log_start(current->audit_context, GFP_ATOMIC,
+                             AUDIT_MAC_IPSEC_EVENT);
+       if (audit_buf == NULL)
+               return NULL;
+
+       audit_log_format(audit_buf, "auid=%u", auid);
+
+       if (sid != 0 &&
+           security_secid_to_secctx(sid, &secctx, &secctx_len) == 0) {
+               audit_log_format(audit_buf, " subj=%s", secctx);
+               security_release_secctx(secctx, secctx_len);
+       } else
+               audit_log_task_context(audit_buf);
+       return audit_buf;
+}
+
+extern void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
+                                 u32 auid, u32 sid);
+extern void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
+                                 u32 auid, u32 sid);
+extern void xfrm_audit_state_add(struct xfrm_state *x, int result,
+                                u32 auid, u32 sid);
+extern void xfrm_audit_state_delete(struct xfrm_state *x, int result,
+                                   u32 auid, u32 sid);
 #else
-#define xfrm_audit_log(a,s,t,r,p,x) do { ; } while (0)
+#define xfrm_audit_policy_add(x, r, a, s)      do { ; } while (0)
+#define xfrm_audit_policy_delete(x, r, a, s)   do { ; } while (0)
+#define xfrm_audit_state_add(x, r, a, s)       do { ; } while (0)
+#define xfrm_audit_state_delete(x, r, a, s)    do { ; } while (0)
 #endif /* CONFIG_AUDITSYSCALL */
 
 static inline void xfrm_pol_hold(struct xfrm_policy *policy)
@@ -981,9 +1043,9 @@ extern void xfrm_spd_getinfo(struct xfrmk_spdinfo *si);
 extern int xfrm_replay_check(struct xfrm_state *x, __be32 seq);
 extern void xfrm_replay_advance(struct xfrm_state *x, __be32 seq);
 extern void xfrm_replay_notify(struct xfrm_state *x, int event);
-extern int xfrm_state_check(struct xfrm_state *x, struct sk_buff *skb);
 extern int xfrm_state_mtu(struct xfrm_state *x, int mtu);
 extern int xfrm_init_state(struct xfrm_state *x);
+extern int xfrm_output(struct sk_buff *skb);
 extern int xfrm4_rcv(struct sk_buff *skb);
 extern int xfrm4_output(struct sk_buff *skb);
 extern int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family);
@@ -1034,7 +1096,7 @@ struct xfrm_policy *xfrm_policy_bysel_ctx(u8 type, int dir,
 struct xfrm_policy *xfrm_policy_byid(u8, int dir, u32 id, int delete, int *err);
 int xfrm_policy_flush(u8 type, struct xfrm_audit *audit_info);
 u32 xfrm_get_acqseq(void);
-void xfrm_alloc_spi(struct xfrm_state *x, __be32 minspi, __be32 maxspi);
+extern int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi);
 struct xfrm_state * xfrm_find_acq(u8 mode, u32 reqid, u8 proto,
                                  xfrm_address_t *daddr, xfrm_address_t *saddr,
                                  int create, unsigned short family);
@@ -1113,12 +1175,6 @@ static inline int xfrm_aevent_is_on(void)
        return ret;
 }
 
-static inline void xfrm_aevent_doreplay(struct xfrm_state *x)
-{
-       if (xfrm_aevent_is_on())
-               xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
-}
-
 #ifdef CONFIG_XFRM_MIGRATE
 static inline struct xfrm_algo *xfrm_algo_clone(struct xfrm_algo *orig)
 {