21 files changed, 42 insertions, 39 deletions

diff --git a/include/linux/xfrm.h b/include/linux/xfrm.h
index 46a15c7a1a13..5154064b6d95 100644
--- a/include/linux/xfrm.h
+++ b/include/linux/xfrm.h
@@ -120,7 +120,9 @@ enum
 
 #define XFRM_MODE_TRANSPORT 0
 #define XFRM_MODE_TUNNEL 1
-#define XFRM_MODE_MAX 2
+#define XFRM_MODE_ROUTEOPTIMIZATION 2
+#define XFRM_MODE_IN_TRIGGER 3
+#define XFRM_MODE_MAX 4
 
 /* Netlink configuration messages.  */
 enum {
@@ -247,7 +249,7 @@ struct xfrm_usersa_info {
         __u32                           seq;
         __u32                           reqid;
         __u16                           family;
-        __u8                            mode; /* 0=transport,1=tunnel */
+        __u8                            mode;           /* XFRM_MODE_xxx */
         __u8                            replay_window;
         __u8                            flags;
 #define XFRM_STATE_NOECN        1
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 00bf86e6e82b..762795624b10 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -298,7 +298,7 @@ struct xfrm_tmpl
 
         __u32                   reqid;
 
-/* Mode: transport/tunnel */
+/* Mode: transport, tunnel etc. */
         __u8                    mode;
 
 /* Sharing mode: unique, this session only, this user only etc. */
diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index 008e69d2e423..99542977e47e 100644
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -265,7 +265,7 @@ static int ah_init_state(struct xfrm_state *x)
                 goto error;
         
         x->props.header_len = XFRM_ALIGN8(sizeof(struct ip_auth_hdr) + ahp->icv_trunc_len);
-        if (x->props.mode)
+        if (x->props.mode == XFRM_MODE_TUNNEL)
                 x->props.header_len += sizeof(struct iphdr);
         x->data = ahp;
 
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index b428489f6ccd..e87377e1d6b6 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -248,7 +248,7 @@ static int esp_input(struct xfrm_state *x, struct sk_buff *skb)
                  *    as per draft-ietf-ipsec-udp-encaps-06,
                  *    section 3.1.2
                  */
-                if (!x->props.mode)
+                if (x->props.mode == XFRM_MODE_TRANSPORT)
                         skb->ip_summed = CHECKSUM_UNNECESSARY;
         }
 
@@ -267,7 +267,7 @@ static u32 esp4_get_max_size(struct xfrm_state *x, int mtu)
         struct esp_data *esp = x->data;
         u32 blksize = ALIGN(crypto_blkcipher_blocksize(esp->conf.tfm), 4);
 
-        if (x->props.mode) {
+        if (x->props.mode == XFRM_MODE_TUNNEL) {
                 mtu = ALIGN(mtu + 2, blksize);
         } else {
                 /* The worst case. */
@@ -383,7 +383,7 @@ static int esp_init_state(struct xfrm_state *x)
         if (crypto_blkcipher_setkey(tfm, esp->conf.key, esp->conf.key_len))
                 goto error;
         x->props.header_len = sizeof(struct ip_esp_hdr) + esp->conf.ivlen;
-        if (x->props.mode)
+        if (x->props.mode == XFRM_MODE_TUNNEL)
                 x->props.header_len += sizeof(struct iphdr);
         if (x->encap) {
                 struct xfrm_encap_tmpl *encap = x->encap;
diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
index 5bb9c9f03fb6..17342430a843 100644
--- a/net/ipv4/ipcomp.c
+++ b/net/ipv4/ipcomp.c
@@ -176,7 +176,7 @@ static int ipcomp_output(struct xfrm_state *x, struct sk_buff *skb)
         return 0;
 
 out_ok:
-        if (x->props.mode)
+        if (x->props.mode == XFRM_MODE_TUNNEL)
                 ip_send_check(iph);
         return 0;
 }
@@ -216,7 +216,7 @@ static struct xfrm_state *ipcomp_tunnel_create(struct xfrm_state *x)
         t->id.daddr.a4 = x->id.daddr.a4;
         memcpy(&t->sel, &x->sel, sizeof(t->sel));
         t->props.family = AF_INET;
-        t->props.mode = 1;
+        t->props.mode = XFRM_MODE_TUNNEL;
         t->props.saddr.a4 = x->props.saddr.a4;
         t->props.flags = x->props.flags;
 
@@ -416,7 +416,7 @@ static int ipcomp_init_state(struct xfrm_state *x)
                 goto out;
 
         x->props.header_len = 0;
-        if (x->props.mode)
+        if (x->props.mode == XFRM_MODE_TUNNEL)
                 x->props.header_len += sizeof(struct iphdr);
 
         mutex_lock(&ipcomp_resource_mutex);
@@ -428,7 +428,7 @@ static int ipcomp_init_state(struct xfrm_state *x)
                 goto error;
         mutex_unlock(&ipcomp_resource_mutex);
 
-        if (x->props.mode) {
+        if (x->props.mode == XFRM_MODE_TUNNEL) {
                 err = ipcomp_tunnel_attach(x);
                 if (err)
                         goto error_tunnel;
diff --git a/net/ipv4/xfrm4_input.c b/net/ipv4/xfrm4_input.c
index 817ed84511a6..040e8475f295 100644
--- a/net/ipv4/xfrm4_input.c
+++ b/net/ipv4/xfrm4_input.c
@@ -106,7 +106,7 @@ int xfrm4_rcv_encap(struct sk_buff *skb, __u16 encap_type)
                 if (x->mode->input(x, skb))
                         goto drop;
 
-                if (x->props.mode) {
+                if (x->props.mode == XFRM_MODE_TUNNEL) {
                         decaps = 1;
                         break;
                 }
diff --git a/net/ipv4/xfrm4_output.c b/net/ipv4/xfrm4_output.c
index 4a96a9e3ef3b..5fd115f0c547 100644
--- a/net/ipv4/xfrm4_output.c
+++ b/net/ipv4/xfrm4_output.c
@@ -54,7 +54,7 @@ static int xfrm4_output_one(struct sk_buff *skb)
                         goto error_nolock;
         }
 
-        if (x->props.mode) {
+        if (x->props.mode == XFRM_MODE_TUNNEL) {
                 err = xfrm4_tunnel_check_size(skb);
                 if (err)
                         goto error_nolock;
@@ -85,7 +85,7 @@ static int xfrm4_output_one(struct sk_buff *skb)
                 }
                 dst = skb->dst;
                 x = dst->xfrm;
-        } while (x && !x->props.mode);
+        } while (x && (x->props.mode != XFRM_MODE_TUNNEL));
 
         IPCB(skb)->flags |= IPSKB_XFRM_TRANSFORMED;
         err = 0;
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 8f50eae47d03..a5bed741de2c 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -96,7 +96,7 @@ __xfrm4_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int
 
                 dst1->next = dst_prev;
                 dst_prev = dst1;
-                if (xfrm[i]->props.mode) {
+                if (xfrm[i]->props.mode != XFRM_MODE_TRANSPORT) {
                         remote = xfrm[i]->id.daddr.a4;
                         local  = xfrm[i]->props.saddr.a4;
                         tunnel = 1;
diff --git a/net/ipv4/xfrm4_state.c b/net/ipv4/xfrm4_state.c
index 81e1751c966e..97b0c7589711 100644
--- a/net/ipv4/xfrm4_state.c
+++ b/net/ipv4/xfrm4_state.c
@@ -42,7 +42,7 @@ __xfrm4_init_tempsel(struct xfrm_state *x, struct flowi *fl,
         x->props.saddr = tmpl->saddr;
         if (x->props.saddr.a4 == 0)
                 x->props.saddr.a4 = saddr->a4;
-        if (tmpl->mode && x->props.saddr.a4 == 0) {
+        if (tmpl->mode == XFRM_MODE_TUNNEL && x->props.saddr.a4 == 0) {
                 struct rtable *rt;
                 struct flowi fl_tunnel = {
                         .nl_u = {
diff --git a/net/ipv4/xfrm4_tunnel.c b/net/ipv4/xfrm4_tunnel.c
index f8ceaa127c83..f110af5b1319 100644
--- a/net/ipv4/xfrm4_tunnel.c
+++ b/net/ipv4/xfrm4_tunnel.c
@@ -28,7 +28,7 @@ static int ipip_xfrm_rcv(struct xfrm_state *x, struct sk_buff *skb)
 
 static int ipip_init_state(struct xfrm_state *x)
 {
-        if (!x->props.mode)
+        if (x->props.mode != XFRM_MODE_TUNNEL)
                 return -EINVAL;
 
         if (x->encap)
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index 00ffa7bc6c9f..60954fc7eb36 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -398,7 +398,7 @@ static int ah6_init_state(struct xfrm_state *x)
                 goto error;
         
         x->props.header_len = XFRM_ALIGN8(sizeof(struct ipv6_auth_hdr) + ahp->icv_trunc_len);
-        if (x->props.mode)
+        if (x->props.mode == XFRM_MODE_TUNNEL)
                 x->props.header_len += sizeof(struct ipv6hdr);
         x->data = ahp;
 
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 2ebfd281e721..2b8e52e1d0ab 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -237,7 +237,7 @@ static u32 esp6_get_max_size(struct xfrm_state *x, int mtu)
         struct esp_data *esp = x->data;
         u32 blksize = ALIGN(crypto_blkcipher_blocksize(esp->conf.tfm), 4);
 
-        if (x->props.mode) {
+        if (x->props.mode == XFRM_MODE_TUNNEL) {
                 mtu = ALIGN(mtu + 2, blksize);
         } else {
                 /* The worst case. */
@@ -358,7 +358,7 @@ static int esp6_init_state(struct xfrm_state *x)
         if (crypto_blkcipher_setkey(tfm, esp->conf.key, esp->conf.key_len))
                 goto error;
         x->props.header_len = sizeof(struct ipv6_esp_hdr) + esp->conf.ivlen;
-        if (x->props.mode)
+        if (x->props.mode == XFRM_MODE_TUNNEL)
                 x->props.header_len += sizeof(struct ipv6hdr);
         x->data = esp;
         return 0;
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index a81e9e9d93bd..19eba8d9f851 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -212,7 +212,7 @@ static struct xfrm_state *ipcomp6_tunnel_create(struct xfrm_state *x)
         memcpy(t->id.daddr.a6, x->id.daddr.a6, sizeof(struct in6_addr));
         memcpy(&t->sel, &x->sel, sizeof(t->sel));
         t->props.family = AF_INET6;
-        t->props.mode = 1;
+        t->props.mode = XFRM_MODE_TUNNEL;
         memcpy(t->props.saddr.a6, x->props.saddr.a6, sizeof(struct in6_addr));
 
         if (xfrm_init_state(t))
@@ -417,7 +417,7 @@ static int ipcomp6_init_state(struct xfrm_state *x)
                 goto out;
 
         x->props.header_len = 0;
-        if (x->props.mode)
+        if (x->props.mode == XFRM_MODE_TUNNEL)
                 x->props.header_len += sizeof(struct ipv6hdr);
         
         mutex_lock(&ipcomp6_resource_mutex);
@@ -429,7 +429,7 @@ static int ipcomp6_init_state(struct xfrm_state *x)
                 goto error;
         mutex_unlock(&ipcomp6_resource_mutex);
 
-        if (x->props.mode) {
+        if (x->props.mode == XFRM_MODE_TUNNEL) {
                 err = ipcomp6_tunnel_attach(x);
                 if (err)
                         goto error_tunnel;
diff --git a/net/ipv6/xfrm6_input.c b/net/ipv6/xfrm6_input.c
index 0405d74ff910..ee2f6b3908b6 100644
--- a/net/ipv6/xfrm6_input.c
+++ b/net/ipv6/xfrm6_input.c
@@ -72,7 +72,7 @@ int xfrm6_rcv_spi(struct sk_buff *skb, u32 spi)
                 if (x->mode->input(x, skb))
                         goto drop;
 
-                if (x->props.mode) { /* XXX */
+                if (x->props.mode == XFRM_MODE_TUNNEL) { /* XXX */
                         decaps = 1;
                         break;
                 }
diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
index 6d111743e508..26f18869f77b 100644
--- a/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@ -47,7 +47,7 @@ static int xfrm6_output_one(struct sk_buff *skb)
                         goto error_nolock;
         }
 
-        if (x->props.mode) {
+        if (x->props.mode == XFRM_MODE_TUNNEL) {
                 err = xfrm6_tunnel_check_size(skb);
                 if (err)
                         goto error_nolock;
@@ -80,7 +80,7 @@ static int xfrm6_output_one(struct sk_buff *skb)
                 }
                 dst = skb->dst;
                 x = dst->xfrm;
-        } while (x && !x->props.mode);
+        } while (x && (x->props.mode != XFRM_MODE_TUNNEL));
 
         IP6CB(skb)->flags |= IP6SKB_XFRM_TRANSFORMED;
         err = 0;
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 73cd250aecbb..81355bb50328 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -114,7 +114,7 @@ __xfrm6_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int
 
                 dst1->next = dst_prev;
                 dst_prev = dst1;
-                if (xfrm[i]->props.mode) {
+                if (xfrm[i]->props.mode != XFRM_MODE_TRANSPORT) {
                         remote = (struct in6_addr*)&xfrm[i]->id.daddr;
                         local  = (struct in6_addr*)&xfrm[i]->props.saddr;
                         tunnel = 1;
diff --git a/net/ipv6/xfrm6_state.c b/net/ipv6/xfrm6_state.c
index b33296b3f6de..a1a1f5476442 100644
--- a/net/ipv6/xfrm6_state.c
+++ b/net/ipv6/xfrm6_state.c
@@ -42,7 +42,7 @@ __xfrm6_init_tempsel(struct xfrm_state *x, struct flowi *fl,
         memcpy(&x->props.saddr, &tmpl->saddr, sizeof(x->props.saddr));
         if (ipv6_addr_any((struct in6_addr*)&x->props.saddr))
                 memcpy(&x->props.saddr, saddr, sizeof(x->props.saddr));
-        if (tmpl->mode && ipv6_addr_any((struct in6_addr*)&x->props.saddr)) {
+        if (tmpl->mode == XFRM_MODE_TUNNEL && ipv6_addr_any((struct in6_addr*)&x->props.saddr)) {
                 struct rt6_info *rt;
                 struct flowi fl_tunnel = {
                         .nl_u = {
diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
index c8f9369c2a87..59685ee8f700 100644
--- a/net/ipv6/xfrm6_tunnel.c
+++ b/net/ipv6/xfrm6_tunnel.c
@@ -307,7 +307,7 @@ static int xfrm6_tunnel_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 
 static int xfrm6_tunnel_init_state(struct xfrm_state *x)
 {
-        if (!x->props.mode)
+        if (x->props.mode != XFRM_MODE_TUNNEL)
                 return -EINVAL;
 
         if (x->encap)
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 797c744a8438..19e047b0e678 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1765,7 +1765,7 @@ parse_ipsecrequest(struct xfrm_policy *xp, struct sadb_x_ipsecrequest *rq)
         }
 
         /* addresses present only in tunnel mode */
-        if (t->mode) {
+        if (t->mode == XFRM_MODE_TUNNEL) {
                 switch (xp->family) {
                 case AF_INET:
                         sin = (void*)(rq+1);
@@ -1997,7 +1997,7 @@ static void pfkey_xfrm_policy2msg(struct sk_buff *skb, struct xfrm_policy *xp, i
                 int req_size;
 
                 req_size = sizeof(struct sadb_x_ipsecrequest);
-                if (t->mode)
+                if (t->mode == XFRM_MODE_TUNNEL)
                         req_size += 2*socklen;
                 else
                         size -= 2*socklen;
@@ -2013,7 +2013,7 @@ static void pfkey_xfrm_policy2msg(struct sk_buff *skb, struct xfrm_policy *xp, i
                 if (t->optional)
                         rq->sadb_x_ipsecrequest_level = IPSEC_LEVEL_USE;
                 rq->sadb_x_ipsecrequest_reqid = t->reqid;
-                if (t->mode) {
+                if (t->mode == XFRM_MODE_TUNNEL) {
                         switch (xp->family) {
                         case AF_INET:
                                 sin = (void*)(rq+1);
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 32c963c90573..a0d58971391d 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -779,7 +779,7 @@ xfrm_tmpl_resolve(struct xfrm_policy *policy, struct flowi *fl,
                 xfrm_address_t *local  = saddr;
                 struct xfrm_tmpl *tmpl = &policy->xfrm_vec[i];
 
-                if (tmpl->mode) {
+                if (tmpl->mode == XFRM_MODE_TUNNEL) {
                         remote = &tmpl->id.daddr;
                         local = &tmpl->saddr;
                 }
@@ -1005,7 +1005,8 @@ xfrm_state_ok(struct xfrm_tmpl *tmpl, struct xfrm_state *x,
                 (x->props.reqid == tmpl->reqid || !tmpl->reqid) &&
                 x->props.mode == tmpl->mode &&
                 (tmpl->aalgos & (1<<x->props.aalgo)) &&
-                !(x->props.mode && xfrm_state_addr_cmp(tmpl, x, family));
+                !(x->props.mode != XFRM_MODE_TRANSPORT &&
+                  xfrm_state_addr_cmp(tmpl, x, family));
 }
 
 static inline int
@@ -1015,14 +1016,14 @@ xfrm_policy_ok(struct xfrm_tmpl *tmpl, struct sec_path *sp, int start,
         int idx = start;
 
         if (tmpl->optional) {
-                if (!tmpl->mode)
+                if (tmpl->mode == XFRM_MODE_TRANSPORT)
                         return start;
         } else
                 start = -1;
         for (; idx < sp->len; idx++) {
                 if (xfrm_state_ok(tmpl, sp->xvec[idx], family))
                         return ++idx;
-                if (sp->xvec[idx]->props.mode)
+                if (sp->xvec[idx]->props.mode != XFRM_MODE_TRANSPORT)
                         break;
         }
         return start;
@@ -1047,7 +1048,7 @@ EXPORT_SYMBOL(xfrm_decode_session);
 static inline int secpath_has_tunnel(struct sec_path *sp, int k)
 {
         for (; k < sp->len; k++) {
-                if (sp->xvec[k]->props.mode)
+                if (sp->xvec[k]->props.mode != XFRM_MODE_TRANSPORT)
                         return 1;
         }
 
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index f70e158874d2..0d580ac19771 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -174,8 +174,8 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
 
         err = -EINVAL;
         switch (p->mode) {
-        case 0:
-        case 1:
+        case XFRM_MODE_TRANSPORT:
+        case XFRM_MODE_TUNNEL:
                 break;
 
         default: