[XFRM]: Add XFRM_MODE_xxx for future use.

Transformation mode is used as either IPsec transport or tunnel.
It is required to add two more items, route optimization and inbound trigger
for Mobile IPv6.
Based on MIPL2 kernel patch.

This patch was also written by: Ville Nuorvala <vnuorval@tcs.hut.fi>

Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/linux/xfrm.h b/include/linux/xfrm.h
index 46a15c7a1a13efcab599605672b206d9e078452b..5154064b6d958d2b30e77c7adcd124499c38e105 100644 (file)
--- a/include/linux/xfrm.h
+++ b/include/linux/xfrm.h
@@ -120,7 +120,9 @@ enum
 
 #define XFRM_MODE_TRANSPORT 0
 #define XFRM_MODE_TUNNEL 1
-#define XFRM_MODE_MAX 2
+#define XFRM_MODE_ROUTEOPTIMIZATION 2
+#define XFRM_MODE_IN_TRIGGER 3
+#define XFRM_MODE_MAX 4
 
 /* Netlink configuration messages.  */
 enum {
@@ -247,7 +249,7 @@ struct xfrm_usersa_info {
        __u32                           seq;
        __u32                           reqid;
        __u16                           family;
-       __u8                            mode; /* 0=transport,1=tunnel */
+       __u8                            mode;           /* XFRM_MODE_xxx */
        __u8                            replay_window;
        __u8                            flags;
 #define XFRM_STATE_NOECN       1

diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 00bf86e6e82b15bded5dbc46d3f76bf530fd7131..762795624b10a88f67509645ffe64f3ce83368fb 100644 (file)
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -298,7 +298,7 @@ struct xfrm_tmpl
 
        __u32                   reqid;
 
-/* Mode: transport/tunnel */
+/* Mode: transport, tunnel etc. */
        __u8                    mode;
 
 /* Sharing mode: unique, this session only, this user only etc. */

diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index 008e69d2e4239245c4ea4bdbf4f1e59cb4d31c62..99542977e47e1fc5c30674c05fcc02e094c002e3 100644 (file)
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -265,7 +265,7 @@ static int ah_init_state(struct xfrm_state *x)
                goto error;
        
        x->props.header_len = XFRM_ALIGN8(sizeof(struct ip_auth_hdr) + ahp->icv_trunc_len);
-       if (x->props.mode)
+       if (x->props.mode == XFRM_MODE_TUNNEL)
                x->props.header_len += sizeof(struct iphdr);
        x->data = ahp;
 

diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index b428489f6ccd90f7226be6000763915ee3c2eeec..e87377e1d6b64cd299a215ee32d60a9d139a317d 100644 (file)
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -248,7 +248,7 @@ static int esp_input(struct xfrm_state *x, struct sk_buff *skb)
                 *    as per draft-ietf-ipsec-udp-encaps-06,
                 *    section 3.1.2
                 */
-               if (!x->props.mode)
+               if (x->props.mode == XFRM_MODE_TRANSPORT)
                        skb->ip_summed = CHECKSUM_UNNECESSARY;
        }
 
@@ -267,7 +267,7 @@ static u32 esp4_get_max_size(struct xfrm_state *x, int mtu)
        struct esp_data *esp = x->data;
        u32 blksize = ALIGN(crypto_blkcipher_blocksize(esp->conf.tfm), 4);
 
-       if (x->props.mode) {
+       if (x->props.mode == XFRM_MODE_TUNNEL) {
                mtu = ALIGN(mtu + 2, blksize);
        } else {
                /* The worst case. */
@@ -383,7 +383,7 @@ static int esp_init_state(struct xfrm_state *x)
        if (crypto_blkcipher_setkey(tfm, esp->conf.key, esp->conf.key_len))
                goto error;
        x->props.header_len = sizeof(struct ip_esp_hdr) + esp->conf.ivlen;
-       if (x->props.mode)
+       if (x->props.mode == XFRM_MODE_TUNNEL)
                x->props.header_len += sizeof(struct iphdr);
        if (x->encap) {
                struct xfrm_encap_tmpl *encap = x->encap;

diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
index 5bb9c9f03fb6dbf23c7831129e86016255f12830..17342430a843bc20781590c79f210564221905b4 100644 (file)
--- a/net/ipv4/ipcomp.c
+++ b/net/ipv4/ipcomp.c
@@ -176,7 +176,7 @@ static int ipcomp_output(struct xfrm_state *x, struct sk_buff *skb)
        return 0;
 
 out_ok:
-       if (x->props.mode)
+       if (x->props.mode == XFRM_MODE_TUNNEL)
                ip_send_check(iph);
        return 0;
 }
@@ -216,7 +216,7 @@ static struct xfrm_state *ipcomp_tunnel_create(struct xfrm_state *x)
        t->id.daddr.a4 = x->id.daddr.a4;
        memcpy(&t->sel, &x->sel, sizeof(t->sel));
        t->props.family = AF_INET;
-       t->props.mode = 1;
+       t->props.mode = XFRM_MODE_TUNNEL;
        t->props.saddr.a4 = x->props.saddr.a4;
        t->props.flags = x->props.flags;
 
@@ -416,7 +416,7 @@ static int ipcomp_init_state(struct xfrm_state *x)
                goto out;
 
        x->props.header_len = 0;
-       if (x->props.mode)
+       if (x->props.mode == XFRM_MODE_TUNNEL)
                x->props.header_len += sizeof(struct iphdr);
 
        mutex_lock(&ipcomp_resource_mutex);
@@ -428,7 +428,7 @@ static int ipcomp_init_state(struct xfrm_state *x)
                goto error;
        mutex_unlock(&ipcomp_resource_mutex);
 
-       if (x->props.mode) {
+       if (x->props.mode == XFRM_MODE_TUNNEL) {
                err = ipcomp_tunnel_attach(x);
                if (err)
                        goto error_tunnel;

diff --git a/net/ipv4/xfrm4_input.c b/net/ipv4/xfrm4_input.c
index 817ed84511a6f67051800f6a140ab1a1f34d2eaf..040e8475f295c1cefcb3350099f57feb08308d56 100644 (file)
--- a/net/ipv4/xfrm4_input.c
+++ b/net/ipv4/xfrm4_input.c
@@ -106,7 +106,7 @@ int xfrm4_rcv_encap(struct sk_buff *skb, __u16 encap_type)
                if (x->mode->input(x, skb))
                        goto drop;
 
-               if (x->props.mode) {
+               if (x->props.mode == XFRM_MODE_TUNNEL) {
                        decaps = 1;
                        break;
                }

diff --git a/net/ipv4/xfrm4_output.c b/net/ipv4/xfrm4_output.c
index 4a96a9e3ef3bc99c80c95ae62b38b2caf58072e4..5fd115f0c54784d30ab2b7e741d28f0b53fa11ae 100644 (file)
--- a/net/ipv4/xfrm4_output.c
+++ b/net/ipv4/xfrm4_output.c
@@ -54,7 +54,7 @@ static int xfrm4_output_one(struct sk_buff *skb)
                        goto error_nolock;
        }
 
-       if (x->props.mode) {
+       if (x->props.mode == XFRM_MODE_TUNNEL) {
                err = xfrm4_tunnel_check_size(skb);
                if (err)
                        goto error_nolock;
@@ -85,7 +85,7 @@ static int xfrm4_output_one(struct sk_buff *skb)
                }
                dst = skb->dst;
                x = dst->xfrm;
-       } while (x && !x->props.mode);
+       } while (x && (x->props.mode != XFRM_MODE_TUNNEL));
 
        IPCB(skb)->flags |= IPSKB_XFRM_TRANSFORMED;
        err = 0;

diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 8f50eae47d039e3d1fbb69dac42db60e1eb1b53e..a5bed741de2c1e65f262c7bcfd3086084792d716 100644 (file)
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -96,7 +96,7 @@ __xfrm4_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int
 
                dst1->next = dst_prev;
                dst_prev = dst1;
-               if (xfrm[i]->props.mode) {
+               if (xfrm[i]->props.mode != XFRM_MODE_TRANSPORT) {
                        remote = xfrm[i]->id.daddr.a4;
                        local  = xfrm[i]->props.saddr.a4;
                        tunnel = 1;

diff --git a/net/ipv4/xfrm4_state.c b/net/ipv4/xfrm4_state.c
index 81e1751c966e1008256d01bfc845588038147523..97b0c7589711c549d51f59002da48dd83eecf1dc 100644 (file)
--- a/net/ipv4/xfrm4_state.c
+++ b/net/ipv4/xfrm4_state.c
@@ -42,7 +42,7 @@ __xfrm4_init_tempsel(struct xfrm_state *x, struct flowi *fl,
        x->props.saddr = tmpl->saddr;
        if (x->props.saddr.a4 == 0)
                x->props.saddr.a4 = saddr->a4;
-       if (tmpl->mode && x->props.saddr.a4 == 0) {
+       if (tmpl->mode == XFRM_MODE_TUNNEL && x->props.saddr.a4 == 0) {
                struct rtable *rt;
                struct flowi fl_tunnel = {
                        .nl_u = {

diff --git a/net/ipv4/xfrm4_tunnel.c b/net/ipv4/xfrm4_tunnel.c
index f8ceaa127c836d4bc6e626ae95eebf22f190a04d..f110af5b1319f0968a4278283cdaa171761d6e75 100644 (file)
--- a/net/ipv4/xfrm4_tunnel.c
+++ b/net/ipv4/xfrm4_tunnel.c
@@ -28,7 +28,7 @@ static int ipip_xfrm_rcv(struct xfrm_state *x, struct sk_buff *skb)
 
 static int ipip_init_state(struct xfrm_state *x)
 {
-       if (!x->props.mode)
+       if (x->props.mode != XFRM_MODE_TUNNEL)
                return -EINVAL;
 
        if (x->encap)

diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index 00ffa7bc6c9f4a527e2976fb53c93352842300af..60954fc7eb36eb0a013e661248a647e10352651e 100644 (file)
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -398,7 +398,7 @@ static int ah6_init_state(struct xfrm_state *x)
                goto error;
        
        x->props.header_len = XFRM_ALIGN8(sizeof(struct ipv6_auth_hdr) + ahp->icv_trunc_len);
-       if (x->props.mode)
+       if (x->props.mode == XFRM_MODE_TUNNEL)
                x->props.header_len += sizeof(struct ipv6hdr);
        x->data = ahp;
 

diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 2ebfd281e7218b98dc74a4f7ccafba5bdaeee603..2b8e52e1d0ab87b6d936bbce9d2d258c935f76d5 100644 (file)
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -237,7 +237,7 @@ static u32 esp6_get_max_size(struct xfrm_state *x, int mtu)
        struct esp_data *esp = x->data;
        u32 blksize = ALIGN(crypto_blkcipher_blocksize(esp->conf.tfm), 4);
 
-       if (x->props.mode) {
+       if (x->props.mode == XFRM_MODE_TUNNEL) {
                mtu = ALIGN(mtu + 2, blksize);
        } else {
                /* The worst case. */
@@ -358,7 +358,7 @@ static int esp6_init_state(struct xfrm_state *x)
        if (crypto_blkcipher_setkey(tfm, esp->conf.key, esp->conf.key_len))
                goto error;
        x->props.header_len = sizeof(struct ipv6_esp_hdr) + esp->conf.ivlen;
-       if (x->props.mode)
+       if (x->props.mode == XFRM_MODE_TUNNEL)
                x->props.header_len += sizeof(struct ipv6hdr);
        x->data = esp;
        return 0;

diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index a81e9e9d93bd25f85d6f7b45e7f001ae7e1a31c8..19eba8d9f851e38d7f69f0a2354c09361b19f52e 100644 (file)
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -212,7 +212,7 @@ static struct xfrm_state *ipcomp6_tunnel_create(struct xfrm_state *x)
        memcpy(t->id.daddr.a6, x->id.daddr.a6, sizeof(struct in6_addr));
        memcpy(&t->sel, &x->sel, sizeof(t->sel));
        t->props.family = AF_INET6;
-       t->props.mode = 1;
+       t->props.mode = XFRM_MODE_TUNNEL;
        memcpy(t->props.saddr.a6, x->props.saddr.a6, sizeof(struct in6_addr));
 
        if (xfrm_init_state(t))
@@ -417,7 +417,7 @@ static int ipcomp6_init_state(struct xfrm_state *x)
                goto out;
 
        x->props.header_len = 0;
-       if (x->props.mode)
+       if (x->props.mode == XFRM_MODE_TUNNEL)
                x->props.header_len += sizeof(struct ipv6hdr);
        
        mutex_lock(&ipcomp6_resource_mutex);
@@ -429,7 +429,7 @@ static int ipcomp6_init_state(struct xfrm_state *x)
                goto error;
        mutex_unlock(&ipcomp6_resource_mutex);
 
-       if (x->props.mode) {
+       if (x->props.mode == XFRM_MODE_TUNNEL) {
                err = ipcomp6_tunnel_attach(x);
                if (err)
                        goto error_tunnel;

diff --git a/net/ipv6/xfrm6_input.c b/net/ipv6/xfrm6_input.c
index 0405d74ff910098f54d23a042bf3995a4a99e593..ee2f6b3908b634708caae1c478f20773f26ce23e 100644 (file)
--- a/net/ipv6/xfrm6_input.c
+++ b/net/ipv6/xfrm6_input.c
@@ -72,7 +72,7 @@ int xfrm6_rcv_spi(struct sk_buff *skb, u32 spi)
                if (x->mode->input(x, skb))
                        goto drop;
 
-               if (x->props.mode) { /* XXX */
+               if (x->props.mode == XFRM_MODE_TUNNEL) { /* XXX */
                        decaps = 1;
                        break;
                }

diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
index 6d111743e508383d4329c3da9ef9c785cec65aad..26f18869f77b1376708d4deadb61e36269df4009 100644 (file)
--- a/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@ -47,7 +47,7 @@ static int xfrm6_output_one(struct sk_buff *skb)
                        goto error_nolock;
        }
 
-       if (x->props.mode) {
+       if (x->props.mode == XFRM_MODE_TUNNEL) {
                err = xfrm6_tunnel_check_size(skb);
                if (err)
                        goto error_nolock;
@@ -80,7 +80,7 @@ static int xfrm6_output_one(struct sk_buff *skb)
                }
                dst = skb->dst;
                x = dst->xfrm;
-       } while (x && !x->props.mode);
+       } while (x && (x->props.mode != XFRM_MODE_TUNNEL));
 
        IP6CB(skb)->flags |= IP6SKB_XFRM_TRANSFORMED;
        err = 0;

diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 73cd250aecbb7afeca2fa667ee9652b52aa9ec16..81355bb5032826a8205567a5a43bc65497223ef1 100644 (file)
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -114,7 +114,7 @@ __xfrm6_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int
 
                dst1->next = dst_prev;
                dst_prev = dst1;
-               if (xfrm[i]->props.mode) {
+               if (xfrm[i]->props.mode != XFRM_MODE_TRANSPORT) {
                        remote = (struct in6_addr*)&xfrm[i]->id.daddr;
                        local  = (struct in6_addr*)&xfrm[i]->props.saddr;
                        tunnel = 1;

diff --git a/net/ipv6/xfrm6_state.c b/net/ipv6/xfrm6_state.c
index b33296b3f6de5ddd25a818ba6ae306444770cfe8..a1a1f5476442406ac841d4e716798e49f1d30981 100644 (file)
--- a/net/ipv6/xfrm6_state.c
+++ b/net/ipv6/xfrm6_state.c
@@ -42,7 +42,7 @@ __xfrm6_init_tempsel(struct xfrm_state *x, struct flowi *fl,
        memcpy(&x->props.saddr, &tmpl->saddr, sizeof(x->props.saddr));
        if (ipv6_addr_any((struct in6_addr*)&x->props.saddr))
                memcpy(&x->props.saddr, saddr, sizeof(x->props.saddr));
-       if (tmpl->mode && ipv6_addr_any((struct in6_addr*)&x->props.saddr)) {
+       if (tmpl->mode == XFRM_MODE_TUNNEL && ipv6_addr_any((struct in6_addr*)&x->props.saddr)) {
                struct rt6_info *rt;
                struct flowi fl_tunnel = {
                        .nl_u = {

diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
index c8f9369c2a876f0f3f9e503e8ede74292802ce79..59685ee8f700d9690180560180320064912ceda8 100644 (file)
--- a/net/ipv6/xfrm6_tunnel.c
+++ b/net/ipv6/xfrm6_tunnel.c
@@ -307,7 +307,7 @@ static int xfrm6_tunnel_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 
 static int xfrm6_tunnel_init_state(struct xfrm_state *x)
 {
-       if (!x->props.mode)
+       if (x->props.mode != XFRM_MODE_TUNNEL)
                return -EINVAL;
 
        if (x->encap)

diff --git a/net/key/af_key.c b/net/key/af_key.c
index 797c744a843829af61eaa6a0ec545f54d0d9087f..19e047b0e6786c700462527c860066f6bac4e240 100644 (file)
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1765,7 +1765,7 @@ parse_ipsecrequest(struct xfrm_policy *xp, struct sadb_x_ipsecrequest *rq)
        }
 
        /* addresses present only in tunnel mode */
-       if (t->mode) {
+       if (t->mode == XFRM_MODE_TUNNEL) {
                switch (xp->family) {
                case AF_INET:
                        sin = (void*)(rq+1);
@@ -1997,7 +1997,7 @@ static void pfkey_xfrm_policy2msg(struct sk_buff *skb, struct xfrm_policy *xp, i
                int req_size;
 
                req_size = sizeof(struct sadb_x_ipsecrequest);
-               if (t->mode)
+               if (t->mode == XFRM_MODE_TUNNEL)
                        req_size += 2*socklen;
                else
                        size -= 2*socklen;
@@ -2013,7 +2013,7 @@ static void pfkey_xfrm_policy2msg(struct sk_buff *skb, struct xfrm_policy *xp, i
                if (t->optional)
                        rq->sadb_x_ipsecrequest_level = IPSEC_LEVEL_USE;
                rq->sadb_x_ipsecrequest_reqid = t->reqid;
-               if (t->mode) {
+               if (t->mode == XFRM_MODE_TUNNEL) {
                        switch (xp->family) {
                        case AF_INET:
                                sin = (void*)(rq+1);

diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 32c963c9057354431f81f934235f2aa2785fe783..a0d58971391d007aa9f05eec72863608d0dd13a6 100644 (file)
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -779,7 +779,7 @@ xfrm_tmpl_resolve(struct xfrm_policy *policy, struct flowi *fl,
                xfrm_address_t *local  = saddr;
                struct xfrm_tmpl *tmpl = &policy->xfrm_vec[i];
 
-               if (tmpl->mode) {
+               if (tmpl->mode == XFRM_MODE_TUNNEL) {
                        remote = &tmpl->id.daddr;
                        local = &tmpl->saddr;
                }
@@ -1005,7 +1005,8 @@ xfrm_state_ok(struct xfrm_tmpl *tmpl, struct xfrm_state *x,
                (x->props.reqid == tmpl->reqid || !tmpl->reqid) &&
                x->props.mode == tmpl->mode &&
                (tmpl->aalgos & (1<<x->props.aalgo)) &&
-               !(x->props.mode && xfrm_state_addr_cmp(tmpl, x, family));
+               !(x->props.mode != XFRM_MODE_TRANSPORT &&
+                 xfrm_state_addr_cmp(tmpl, x, family));
 }
 
 static inline int
@@ -1015,14 +1016,14 @@ xfrm_policy_ok(struct xfrm_tmpl *tmpl, struct sec_path *sp, int start,
        int idx = start;
 
        if (tmpl->optional) {
-               if (!tmpl->mode)
+               if (tmpl->mode == XFRM_MODE_TRANSPORT)
                        return start;
        } else
                start = -1;
        for (; idx < sp->len; idx++) {
                if (xfrm_state_ok(tmpl, sp->xvec[idx], family))
                        return ++idx;
-               if (sp->xvec[idx]->props.mode)
+               if (sp->xvec[idx]->props.mode != XFRM_MODE_TRANSPORT)
                        break;
        }
        return start;
@@ -1047,7 +1048,7 @@ EXPORT_SYMBOL(xfrm_decode_session);
 static inline int secpath_has_tunnel(struct sec_path *sp, int k)
 {
        for (; k < sp->len; k++) {
-               if (sp->xvec[k]->props.mode)
+               if (sp->xvec[k]->props.mode != XFRM_MODE_TRANSPORT)
                        return 1;
        }
 

diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index f70e158874d26ec97c10ea56e85edf3d5b65a67b..0d580ac1977158f71c2cc656f19183516ba6ff86 100644 (file)
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -174,8 +174,8 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
 
        err = -EINVAL;
        switch (p->mode) {
-       case 0:
-       case 1:
+       case XFRM_MODE_TRANSPORT:
+       case XFRM_MODE_TUNNEL:
                break;
 
        default: