[IPSEC]: Add support for combined mode algorithms

This patch adds support for combined mode algorithms with GCM being
the first algorithm supported.

Combined mode algorithms can be added through the xfrm_user interface
using the new algorithm payload type XFRMA_ALG_AEAD.  Each algorithms
is identified by its name and the ICV length.

For the purposes of matching algorithms in xfrm_tmpl structures,
combined mode algorithms occupy the same name space as encryption
algorithms.  This is in line with how they are negotiated using IKE.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

2 files changed, 14 insertions, 0 deletions

diff --git a/include/linux/pfkeyv2.h b/include/linux/pfkeyv2.h
index d9db5f62ee48..6db69ff5d83e 100644
--- a/include/linux/pfkeyv2.h
+++ b/include/linux/pfkeyv2.h
@@ -298,6 +298,12 @@ struct sadb_x_sec_ctx {
 #define SADB_X_EALG_BLOWFISHCBC         7
 #define SADB_EALG_NULL                  11
 #define SADB_X_EALG_AESCBC              12
+#define SADB_X_EALG_AES_CCM_ICV8        14
+#define SADB_X_EALG_AES_CCM_ICV12       15
+#define SADB_X_EALG_AES_CCM_ICV16       16
+#define SADB_X_EALG_AES_GCM_ICV8        18
+#define SADB_X_EALG_AES_GCM_ICV12       19
+#define SADB_X_EALG_AES_GCM_ICV16       20
 #define SADB_X_EALG_CAMELLIACBC         22
 #define SADB_EALG_MAX                   253 /* last EALG */
 /* private allocations should use 249-255 (RFC2407) */
diff --git a/include/linux/xfrm.h b/include/linux/xfrm.h
index 9b5b00c4ef9d..e31b8c84f2c9 100644
--- a/include/linux/xfrm.h
+++ b/include/linux/xfrm.h
@@ -96,6 +96,13 @@ struct xfrm_algo {
         char            alg_key[0];
 };
 
+struct xfrm_algo_aead {
+        char    alg_name[64];
+        int     alg_key_len;    /* in bits */
+        int     alg_icv_len;    /* in bits */
+        char    alg_key[0];
+};
+
 struct xfrm_stats {
         __u32   replay_window;
         __u32   replay;
@@ -270,6 +277,7 @@ enum xfrm_attr_type_t {
         XFRMA_LASTUSED,
         XFRMA_POLICY_TYPE,      /* struct xfrm_userpolicy_type */
         XFRMA_MIGRATE,
+        XFRMA_ALG_AEAD,         /* struct xfrm_algo_aead */
         __XFRMA_MAX
 
 #define XFRMA_MAX (__XFRMA_MAX - 1)